Live Feed

Malicious code in @testsecuiitytestme/cache-helper (npm)

A recent Shai-Hulud attack shows defenders need real-time visibility into production code and affected services to respond to supply chain compromises.

Merge PR #6483 from @memx13 - Fix Image path separator in `Shai-Hulud 2.0 Malicious NPM Package Installation - Linux` fix: Shai-Hulud 2.0 Malicious NPM Package Installation - Linux - use the Linux path separator in the Image filter

Every Cybersecurity Awareness Month campaign rests on four habits: Strong passwords, Multifactor authentication, Spotting phishing, and keeping software updated. All four assume a person is the one signing in, reading the message and clicking install. At a growing number of companies that person is now an AI agent ,…

IntroductionOn August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP. ChainDrop anchored its C2 infrastructure in an Ethereum smart contract, allowing the attacker to rotate domains with a…

On August 4, 2026, Elastic Security Labs identified a new Shai-Hulud campaign targeting the maintainer of keyv , a widely used key-value storage library. The attackers trojanized the monorepo and embedded a self-propagating worm called CHAINDROP that uses stolen npm credentials to automatically backdoor every other…

IntroductionSince Zscaler ThreatLabz published its analysis of Shai-Hulud V2 in November 2025, the campaign has continued to evolve in ways that distinguish it from more typical software supply chain attacks. Over the last six months, the activity expanded beyond npm into the Python Package Index (PyPI), shifted from…