ChainDrop/Mini Shai-Hulud npm Worm setup.mjs Preinstall Dropper

Jeff Daisley@JDaisley

•updated Aug 4, 2026•1•0•8

Detects ChainDrop/Mini Shai-Hulud npm worm preinstall dropper (setup.mjs) injected into trojanized npm packages including keyv, cacheable, and flat-cache