Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages

Elastic Security Labs details a large-scale supply-chain compromise where the Shai-Hulud actor trojanized the keyv monorepo and deployed a self-propagating worm (CHAINDROP) that uses stolen npm credentials to backdoor hundreds of packages. The worm executes via preinstall hooks, harvests extensive developer and AI/cloud credentials, dynamically resolves C2 via an Ethereum smart contract (with fallback channels), and has already impacted 400+ npm packages with widespread downstream exposure; the report includes IOCs, detection rules, and mitigation recommendations.