ChainDrop

Reported Context (10)

Recent supply chain campaigns, most notably the ChainDrop npm worm and the PolinRider campaign, demonstrate how open-source packages are engineered specifically to extract ephemeral cloud access keys and establish Supply-Chain Malware Uses Blockchain Transactions for Resilient Command and Control
August’s security briefing covers ChainDrop’s rapid npm supply chain poisoning, Ghostjacking attacks against AI coding agents, and incidents where Claude Code was used in ransomware intrusions. August 2026 Security Briefing: ChainDrop, AI Agent Risks and Cl0p
ChainDrop arrived in August 2026 as a Bun loaded npm worm that harvests CI/CD credentials and uses an Ethereum smart contract as a dead drop for its command and control address. StepSecurity Report Tracks 56 Open-Source Supply-Chain Attacks in 12 Months
It highlights families such as ChainDrop, TroyDen, DeadLock, CLEARSHORT, JADESNOW, GlassWorm, SalatStealer, and TONResolver, and shows how Netskope detects these blockchain RPC patterns. Malware Uses Blockchain Dead Drops to Retrieve Runtime C2 Pointers
families across three chains (EVM, Solana, TON) using the same core trick: including the August 2026 ChainDrop (“mini Shai-Hulud”) npm supply-chain compromise that uses an Ethereum eth_call dead drop. How Malware Uses Blockchain Dead Drops to Rotate C2 Infrastructure

CVE (4)

Malware (12)

People (8)

Threat Actors (6)

MITRE ATT&CK (16)

Vendors (30)

Products (84)

Tools (5)

Industries (5)

Countries (3)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.