Shai-Hulud ChainDrop npm Supply Chain Worm | Node.js/npm Supply Chain Compromise - Bun Downloader & Credential Harvester (gh-token-monitor)

Yuvraj Singh@S41NT

•updated Aug 7, 2026•23•0•26

Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.