⚠ Critical Malware Advisory — supply-chain worm Detected 2026-08-04 · 10:38 UTC
Confirmed malicious. codelake independently detected this at 2026-08-04 · 10:38 UTC — Wiz Research published first (2026-08-04); codelake Research independent cross-verification + precision measurement.
Also documented publicly: Wiz Research IOC list (Wiz Research, 2026-08-04).
Advisory · CLR-2026-3042
Shai-Hulud / ChainDrop — self-propagating npm worm across 665 package versions
codelake Research corpus verified against Wiz Research IOC list — 439/443 unique package names (99% name coverage), 665 flagged versions, 100% detection precision on the ingested subset.
CriticalConfirmed maliciousnpm wormwiz-cross-verified
What happened
On 2026-08-04 (~10:38 UTC) a self-propagating npm supply-chain worm — tracked publicly as Shai-Hulud / ChainDrop — republished malicious versions of hundreds of packages across ~40 npm scopes. Initial entry was a hijacked maintainer GitHub account; propagation was automatic via stolen npm publish tokens and GitHub PATs harvested on each install.
The malicious versions add a preinstall script that invokes node setup.mjs. setup.mjs silently downloads the legitimate Bun runtime, then executes an obfuscated ~728 KB infostealer payload (math_init.js or Math_Symbol.js) which harvests npm tokens, GitHub PATs (classic + fine-grained), OAuth secrets, OIDC JWTs, AWS credentials, Kubernetes service-account tokens, HashiCorp Vault secrets, Stripe keys, and Slack tokens. Persistence is planted into .claude/settings.json and .vscode/tasks.json so the payload re-executes on next IDE / AI-coding-agent session.
Every ingested infected version in the codelake corpus fired pkgbehavior.static.dynamic-exec on the dropper file and pkgbehavior.static.child-spawn-dynamic on setup.mjs. Cross-check against the Wiz Research IOC list yielded 665 verified matches on 439 unique package names — 100% precision on the ingested subset, 99% name coverage of the reference list.
Impact scope
Top affected npm scopes by verified-infected-version count in the codelake corpus:
@servicetitan— 171 versions@onereach— 155 versions@or-sdk— 148 versions@ornikar— 84 versions@qlik— 28 versions@nebula.js— 21 versions@umacloud— 8 versions@arv-bedrock— 5 versions@cacheable— 4 versions@picsart— 2 versions@hubsync— 2 versions@deliveroo— 2 versions
IOCs — dropper filenames + attacker strings
setup.mjs — preinstall entrypoint; downloads bun, invokes payload
math_init.js — ~728 KB obfuscated infostealer payload
Math_Symbol.js — variant name of the same payload
router_runtime.js — additional dropper variant
Shai-Hulud: Here We Go Again — attacker signature (GitHub commit tag)Thebeautifulmarchoftime — attacker marker string in payloadIfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients — attacker marker stringgithub.com — C2; exfiltration commits tagged
Shai-Hulud: Here We Go Again; 821 tagged repos identified by Wiz Verified affected package versions (full list, 665)
@adminide-stack/[email protected], @adminide-stack/[email protected], @arv-bedrock/[email protected], @arv-bedrock/[email protected], @arv-bedrock/[email protected], @arv-bedrock/[email protected], @arv-bedrock/[email protected], @cacheable/[email protected], @cacheable/[email protected], @cacheable/[email protected], @cacheable/[email protected], @deliveroo/[email protected], @deliveroo/[email protected], @hubsync/[email protected], @hubsync/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @nebula.js/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @onereach/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @or-sdk/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @ornikar/[email protected], @picsart/[email protected], @picsart/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @qlik/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @servicetitan/[email protected], @thiennq/[email protected], @thiennq/[email protected], @umacloud/[email protected], @umacloud/[email protected], @umacloud/[email protected], @umacloud/[email protected], @umacloud/[email protected], @umacloud/[email protected], @umacloud/[email protected], @umacloud/[email protected], @workbench-stack/[email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected], [email protected]
Remediation
Credit
Primary detection + IOC list published by Wiz Research. codelake Research contribution: independent cross-verification, precision measurement, and additional coverage-gap analysis against a 1.7M-package continuous npm scan corpus.
Written by codelake Research on 2026-08-05. Wiz Research is the source of record for the 443-name / 2235-version IOC list — codelake's contribution was independent cross-verification of detection quality on our real-time npm ingest: every one of the 665 Wiz-listed versions that fell inside our ingest window fired the correct behavioural signals (100% precision on the ingested subset). The other Wiz-listed versions were removed by npm before our real-time poll could download them (a yank-timing structural gap, addressed separately from this advisory).