Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
5 IOCs
Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
Threat Actors
Excerpt
On August 4, 2026, Elastic Security Labs identified a new Shai-Hulud campaign targeting the maintainer of keyv , a widely used key-value storage library. The attackers trojanized the monorepo and embedded a self-propagating worm called CHAINDROP that uses stolen npm credentials to automatically backdoor every other package the maintainer had publish rights to. The reach of this compromise is significant: keyv alone received over 600 million downloads last month, with related…
Read the original report →Diamond Model
Adversary(1)
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →5 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | npm-cache.com | High | Score 86/100 | First seen |
| Domain | awqhnjewqjkl.icu | High | Score 86/100 | First seen |
| SHA256 | 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668 | High | Score 59/100 | First seen |
| SHA256 | fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb | High | Score 62/100 | First seen |
| SHA256 | 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc | High | Score 62/100 | First seen |
IOC Relationship Graph
Building graph…