Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages

Elastic Security Labs discovered an active Shai-Hulud CHAINDROP supply-chain campaign that trojanized the keyv monorepo and automatically propagates by using stolen npm tokens to backdoor other packages via preinstall hooks; over 400 npm packages were compromised and targeted packages have extremely high monthly downloads. The malware harvests a wide range of credentials (AI tooling, cloud providers, GitHub, npm tokens, SSH keys, Kubernetes tokens), uses an Ethereum smart contract to resolve exfiltration endpoints, and contains a worm component that republishes infected tarballs to npm, with provided IOCs, detection rules, and mitigation guidance.