Provenance Record

Thorough, well-organized News piece (1,113 words) with clear sub-headed sections (initial breach, payload mechanics, self-propagation/exfiltration, scale/lineage, recommendations) appropriate for a fast-moving, multi-source security incident. Represents the most current and comprehensive state of the story (through the August 6 CSA advisory update).

Read all 6 sources in full, including the two also covering this story in the companion submission (PR #2141), plus two unique to this submission (DevOps.com, CSA Singapore advisory). SecurityWeek: confirms the 2,200+ versions/440 packages initial count, the 'evolved descendant of the Shai-Hulud 2.0 worm' / EtherHiding quote verbatim. Wiz: confirms the 'descendant of the \'Mini\' Shai-Hulud malware family' quote verbatim, the Claude/OpenAI/Codex/Cursor/Gemini credential targets, Jenkins master.key, Kubernetes/Vault/cryptocurrency-wallet/etc-shadow targets, and the 'Shai-Hulud: Here We Go Again' exfil-repo description. Snyk: confirms the 09:35:00 UTC [email protected] publish time, the exact package list with versions, the 29,918-byte setup.mjs and 727,680-byte Math_Symbol.js figures (rounding to the article's 'roughly 30-kilobyte' and '728 kilobytes'), and the provenance-boundary quote verbatim. Aikido: confirms the eleven-package list with exact version numbers, the 200-glob-pattern credential scan, the 50-branches/'chore: update config' GitHub App token abuse, the ~1,300 exfil-repo count, the npm-cache[.]com domain, the August 5 'At least 444 packages (across 1381 versions)' update, and the @deliveroo/@picsart/@qlik downstream package names (found in a 'spread to other maintainers' list — confirmed present despite an initial case-sensitive search miss). DevOps.com: confirms the Makari and Kiran Raj quotes verbatim, the 728 KB Math_Symbol.js figure, and the Deliveroo/OneReach/ServiceTitan/Picsart/Qlik organization list with the '50 to 100 newly infected packages every few minutes' figure. CSA Singapore advisory: confirms the 1,300+ versions/2 billion downloads August 6 figures and all four verbatim remediation-action quotes. The internal link to the May 2026 Mini Shai-Hulud article resolves to an existing published article. No misattributions or hallucinated quotes found across any of the 6 sources.

Every specific checked (timestamps, byte sizes, package/version lists, org names, quotes, advisory recommendations) traces exactly to its cited source, including several highly specific technical details (exact byte counts, npm-cache[.]com registration date, branch-commit-author details) that could easily have been garbled but were not.

Clean, thoroughly-sourced, and current submission — the most complete account of the ChainDrop npm supply-chain incident among the two competing submissions received. Approving outright.