Malware
ChainDrop
- First Reported
- Aug 4, 2026
- Latest Reported
- Oct 7, 2026
Reported Context (4)
- Recent supply chain campaigns, most notably the ChainDrop npm worm and the PolinRider campaign, demonstrate how open-source packages are engineered specifically to extract ephemeral cloud access keys and establish Supply-Chain Malware Uses Blockchain Transactions for Resilient Command and Control
- 🪱 ChainDrop infected 400-plus packages: The worm stole developer secrets and republished tainted npm versions through CI. Black Hat and DEF CON Roundup: Hugging Face Compromise, North Korean Operations and Security Funding
- On August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP. ChainDrop anchored its C2 ChainDrop npm Worm Steals Developer Credentials and Spreads Malicious Packages
- This worm was nicknamed 'ChainDrop' by the community. ChainDrop Worm Compromises Hundreds of npm Packages to Steal Credentials and Spread
CVE (3)
Malware (2)
People (8)
Threat Actors (4)
MITRE ATT&CK (9)
Vendors (24)
Products (61)
Tools (5)
Industries (5)
Countries (3)
Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.