ChainDrop supply-chain attack infects over 1,300 npm packages with 2 billion monthly downloads
This digest was compiled by AI from multiple sources — links to the originals are below.
A self-propagating supply-chain worm dubbed ChainDrop has infected more than 1,300 npm packages with over 2 billion monthly downloads, security researchers reported on August 4. The malware automatically executes upon installation, stealing developer credentials and cloud tokens from compromised systems. It spread through the npm registry by hijacking a popular maintainer’s GitHub account and using legitimate CI/CD workflows to publish poisoned releases.
The Attack Chain
The attack began after a threat actor compromised the GitHub account of the maintainer of Keyv, a widely used caching library. The attacker pushed malicious files directly to the main branch of Keyv and its dependencies — including cacheable, flat-cache, and file-entry-cache — then triggered new package releases through the projects’ legitimate GitHub Actions workflows. Because the packages were built and published via trusted CI/CD pipelines, the compromised npm releases carried valid provenance signatures, making detection harder. At least 868 distinct packages across 1,381 versions were confirmed infected, according to security firm Aikido.
Information Stealing
Each poisoned package contains a preinstall script that runs a dropper (setup.mjs) automatically when npm install is executed. The dropper downloads the Bun JavaScript runtime from its official GitHub release and uses it to execute Math_Symbol.js, the main infostealer payload. This payload collects the entire process environment, local configuration and credential files, GitHub personal access tokens (PATs), workflow tokens, and npm tokens. Before exfiltration, tokens are validated in real time against the npm registry’s whoami endpoint. The stolen data is encrypted and sent to a public GitHub repository with the description 'Shai-Hulud: Here We Go Again'.
Self-Propagation
ChainDrop includes self-spreading capabilities, allowing it to infect additional packages belonging to other maintainers that depend on a compromised package. The worm scans infected development systems and CI/CD runners for credentials that grant access to more source code repositories and npm packages. By leveraging collected tokens, it can modify codebases and publish new malicious releases, perpetuating the supply-chain compromise. The malicious JavaScript is heavily obfuscated, and researchers at BleepingComputer also observed a variant using a math_init.js script.
What's Next
Package maintainers are urged to audit their repositories and revoke exposed tokens immediately. It remains unclear whether the npm registry operators or affected organizations can fully identify and remediate all compromised packages, as the worm may have spread to unmonitored dependencies.
2 sources
ChainDrop supply-chain attack infects over 1,300 npm packages with 2 billion monthly downloads
