ChainDrop Mini Shai-Hulud npm Worm Bun-CJS Credential-Stealer Payload

Jeff Daisley@JDaisley

•updated Aug 4, 2026•1•0•7

Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.