Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages

Elastic Security LabsAugust 6, 2026Threat Intel AppSec

Elastic Security Labs identified the return of Shai-Hulud. Attackers compromised the keyv maintainer and deployed CHAINDROP, a worm that uses stolen npm credentials to backdoor co-owned packages totaling over 1.3 billion monthly downloads.

Summary from Elastic Security Labs.

Read the full article at Elastic Security Labs

Explained

The technology and terms in this story. Learn more

TechnologynpmThe package registry for JavaScript: millions of open-source libraries that projects install automatically.
AttackBackdoorA hidden way back into a system that bypasses normal logins.

Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages

Explained

More in Threat Intel

Synthetic identities leave US lenders with $2.4 billion in fraud exposure

Sponsored: Should your threat hunt become a detection?

SECURITY AFFAIRS MALWARE NEWSLETTER ROUND 120

BlackX UEFI bootkit exploits Baton Drop flaw to bypass Secure Boot

Researchers Push Over 2 Million Updates to Remotely Disable Popcorn Time Updater That Could Fuel a Botnet