Elastic Security Labs has identified a return of the Shai-Hulud threat actor, who compromised the maintainer account of the popular npm package 'keyv'. Attackers deployed CHAINDROP, a self-propagating worm that leverages stolen npm credentials to backdoor co-owned packages. The campaign affects over 400 npm packages with a combined total exceeding 1.3 billion monthly downloads, representing a massive supply chain attack. The worm's propagation mechanism relies on abusing the trust relationships between package maintainers and co-owned dependencies. This incident highlights the severe risks of credential compromise in open-source package ecosystems and the cascading impact a single maintainer account takeover can have on the broader software supply chain.