Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages

<p>On August 4, 2026, Elastic Security Labs identified a new Shai-Hulud campaign targeting the maintainer of <code>keyv</code>, a widely used key-value storage library. The attackers trojanized the monorepo and embedded a self-propagating worm called CHAINDROP that uses stolen npm credentials to automatically backdoor every other package the maintainer had publish rights to. The reach of this comp