Historical intelligence backfill. This assessment covers reporting originally published on 2026-08-04 and was added to the RWP archive on 2026-09-07.
ChainDrop was an npm worm with a postinstall — Unit 42 and Microsoft both treated it as self-propagating supply chain
August 2026 ChainDrop reporting is the sequel instinct after Shai-Hulud 2.0: install-time execution, credential harvest, republish. Not a second write-up of the December 2025 worm.
Bottom line up front
CONFIRMED as in-window seeds: Microsoft 4 August 2026 and Unit 42's ChainDrop analysis describe a self-propagating npm worm using postinstall/install-time payload, credential theft, and republish — the 2026 recurrence of the class already covered here as Shai-Hulud 2.0 (December 2025 post). Keep separate: different date, name, and infra. CI is the amplifier. OT: not applicable unless a vendor's npm creds sit on an engineering workstation that also talks to a plant — UNKNOWN, not claimed.
Historical backfill of 4 August 2026 reporting; added 7 September 2026.
What happened
npm install ran attacker code. Tokens in the environment became the next publish. Worm, not a one-package backdoor.
Why it mattered
If you treated Shai-Hulud as a one-off, August is the rebuttal. Lockfiles and ignore-scripts are controls, not culture.
Who / what was affected
npm maintainers and downstream CI. Exact package set belongs in vendor IOCs, not this assessment's copy-paste.
Technical context
Disable lifecycle scripts in CI where possible. Short-lived granular npm tokens. Hunt unexpected publishes from CI identities.
Exploitation / threat status at the time
CONFIRMED vendor-class reporting of a worm.
ASSESSED same economic motive as 2025.
What defenders should have done
- Rotate npm/GitHub/cloud tokens after any unexpected install-time network.
- Pin and verify packages.
- Do not merge this incident into the December Shai-Hulud URL.
RWP assessment
Confidence: High on the class; package lists change faster than this page.
Defensive actions
ignore-scriptsin CI default.- Alert on npm publish from build agents.
- Assume developer laptops are production IdP.