ChainDrop Shai-Hulud 2.0 npm dropper setup.mjs (keyv/cacheable)

Jeff Daisley@JDaisley

•updated Aug 4, 2026•1•0•7

Detects ChainDrop/Shai-Hulud 2.0 npm supply-chain worm preinstall dropper (setup.mjs) injected into keyv, cacheable, flat-cache, file-entry-cache and hundreds of downstream packages on 2026-08-04. Matches by hash and by behavioral strings. Hash IOCs are perishable because the attacker re-obfuscates per wave; the Bun download URL, staging-directory prefix, and payload filenames provide more durable coverage.