ChainDrop Shai-Hulud 2.0 npm Credential-Harvesting Worm

Jeff Daisley@JDaisley

•updated Aug 4, 2026•4•0•15

Detects ChainDrop / Shai-Hulud 2.0 self-propagating npm credential-harvesting worm deployed via keyv/cacheable supply-chain compromise. Matches exact hashes or a combination of unique embedded strings including the dead-man's-switch extortion string, runner-memory secret scrape marker, Ethereum dead-drop repo banner, npm whoami exfil endpoint, fallback commit token, and persistence dropper path.