Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
1 IOC
Tracking Shai-Hulud: Inside the ChainDrop NPM Worm
Excerpt
IntroductionOn August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP. ChainDrop anchored its C2 infrastructure in an Ethereum smart contract, allowing the attacker to rotate domains with a single blockchain transaction and rendering domain-based blocklists ineffective.The attacker compromised the GitHub account of the maintainer of…
Read the original report →Diamond Model
Adversary
Infrastructure(1)
Capability
Victim
Indicators of Compromise
Open the mindmap →1 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| Domain | npm-cache.com | High | Score 86/100 | First seen |
IOC Relationship Graph
Building graph…