ChainDrop worm compromises over 1,300 npm packages totaling 2 billion downloads

A self-propagating piece of malware called ChainDrop has infected more than 1,300 packages that together account for approximately 2 billion monthly downloads on the npm registry.

Attack began with compromise of a prominent maintainer's GitHub account. The supply-chain attack reportedly started after the threat actor took over the GitHub account belonging to the maintainer of Keyv. From there it rapidly expanded to packages linked with major organizations including Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.

Among the infected titles are widely used caching utilities such as Keyv, Cacheable, flat-cache, and file-entry-cache, all maintained by the same individual. The intruder pushed malicious files straight into the main branches of targeted projects before creating fresh releases.

Malware deploys via legitimate GitHub Actions with valid provenance. Because the packages continued to be built and published through their original GitHub Actions workflows, the tainted npm versions carried valid provenance data. A report from Aikido states "at least 868 packages (across 1381 versions) have been compromised by the worm."

Poisoned packages execute a dropper that downloads the Bun runtime. Each compromised package includes a setup.mjs dropper, a Math_Symbol.js infostealer script, and a "preinstall": "node setup.mjs" entry inside its package.json file. Aikido researchers warn that "Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed."

The dropper fetches the official Bun JavaScript runtime from GitHub and uses it to launch the obfuscated Math_Symbol.js payload. Once the infostealer finishes running, the dropper removes the temporary directory it created.

Infostealer targets developer and cloud credentials across multiple services. The script gathers credentials from the local environment, encrypts them, and exfiltrates the data to a public GitHub repository titled "Shai-Hulud: Here We Go Again." Its code also contains self-propagation logic that lets it compromise packages belonging to other maintainers who depended on an earlier infected module.

On infected developer machines and CI/CD runners the malware hunts for any credentials that could unlock further repositories and npm packages. It harvests the full process environment, local config and credential files, GitHub PATs along with workflow tokens and ghp_, gho_, ghs_ patterns, npm tokens starting with npm_, GitHub Actions secrets that extract values marked "isSecret":true on self-hosted runners, AWS credentials, SSM Parameter Store entries using WithDecryption set to true, Secrets Manager items, Kubernetes secrets from reachable namespaces, HashiCorp Vault tokens and KV data, plus database credentials, private keys, and tokens for Stripe, Slack, Twilio, Azure, and GCP.

Indicators of compromise include npm-cache.com domain. Cloud security firm Wiz reports that the domain npm-cache[.]com is being used to exfiltrate stolen data and should be considered a strong indicator of compromise. Administrators who installed any affected package version must treat the affected developer workstation or CI/CD runner as fully compromised even after the package has been removed.