🕵️ ChainDrop

The items that name it 11

• ♫Why♥Not♪ (@Python_s_) on X
  advisoryas threat actors2026-10-09It is written here as ChainDrop (threat label given alongside Shai-Hulud).

  threat label given alongside Shai-Hulud

• TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing Attack
  writeupas classification.key entities2026-10-08
• Evolution of Web3 in Cloud Supply Chain Attacks
  articleas classification.key entities2026-10-07
• Claude Code & Gemini CLI: GitHub Issue → CI Secrets
  writeupas classification.key entities2026-09-01
• The State of Open Source Supply Chain Attacks
  articleas threat actors2026-08-23

  Bun-loaded npm worm that arrived in August 2026; harvests CI/CD credentials and uses an Ethereum smart contract as a dead drop for its command and control address.

• ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2
  writeupas classification.key entities2026-08-16
• Team PCP Stole 78,330 Secrets From 2,186 Organizations. CloudSEK Just Published the List.
  articleas threat actors2026-08-15

  Worm described as part of the broader wave of supply chain attacks alongside Team PCP; reached the CI pipelines of Backstage (CNCF developer portal project), where Harden-Runner flagged its C2 traffic as anomalous in real time.

• 77 "Evil Twin" Open VSX Extensions
  articleas threat actors2026-08-08

  Codename for a software supply chain attack compromising 450 unique npm packages spanning 2,244 artifacts to deliver an information stealer and push trojanized versions using stolen npm tokens

• 'ChainDrop' worm compromises hundreds of popular npm packages
  writeupas threat actors2026-08-04It is written here as ChainDrop (npm worm nicknamed by the community, first seen August 4, 2026).

  npm worm nicknamed by the community, first seen August 4, 2026

• Cooldowns.dev
  articleas classification.key entities2026-05-06
• Shai-Hulud-2.0-Detector — npm supply-chain compromise scanner
  repoas threat actors

  Second wave of the Shai-Hulud campaign, returned August 4, 2026. Attackers compromised the maintainer account behind keyv, cacheable, flat-cache and file-entry-cache, publishing keyv@6.0.0 with a preinstall: node setup.mjs dropper. Steals npm/GitHub/cloud/AI-tool credentials (300+ patterns), persist