ChainDrop npm Worm - CI/CD Secret Scraping via /proc/mem and gh Token Theft

Ethan Andrews@eandrews

•updated Aug 4, 2026•20•0•30

Detects credential and token harvesting behaviors associated with the ChainDrop/Shai-Hulud 2.0 npm worm, specifically targeting CI/CD environments. The rule monitors for unauthorized access to /proc/[pid]/mem to scrape memory for workflow secrets, extraction of OIDC environment variables, and suspicious invocation of the GitHub CLI (gh) to steal authentication tokens.