ChainDrop infects more than 440 NPM packages

Security researchers and platform vendors traced a supply-chain campaign called ChainDrop to a compromised maintainer GitHub account that led to more than 2,200 malicious package versions across over 440 NPM packages. The campaign began on August 4 and initially involved 11 packages in the keyv and cacheable namespaces. The affected packages together register more than 500 million weekly downloads.

The malicious code executed during package installation. Each infected package included a preinstall hook that downloaded the legitimate Bun JavaScript runtime and a roughly 710 KB block of obfuscated second-stage code. The attackers used stolen NPM publishing tokens to enumerate packages available to the compromised identities, download package tarballs, insert a setup loader and the malware, increment patch versions, and republish the modified packages.

The malicious payload searches developer workstations and continuous integration environments for credentials, encrypts discovered secrets, and exfiltrates data. Exfiltration destinations included dynamic HTTPS endpoints and attacker-created public GitHub repositories labeled “Shai-Hulud: Here We Go Again.” Microsoft wrote: “Once executed, the malware searches developer workstations and continuous integration and continuous delivery (CI/CD) environments for NPM, GitHub, cloud, and infrastructure credentials. It uses recovered identities to authenticate to NPM, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault, enabling it to enumerate packages, repositories, workflow secrets, cloud parameters, and secret-store values.”

The campaign also leveraged stolen GitHub credentials and GitHub Actions to inject configuration files and create persistence, enabling a developer-to-developer infection path. JFrog and other analysts found that the initial poisoning led to 433 additional packages being infected through these propagation mechanisms. StepSecurity reported that 2,212 malicious package iterations were published within roughly four hours on August 4.

Analysts identified the active malware as a descendant of the Shai-Hulud 2.0 worm. The threat uses an Ethereum-based command-and-control technique known as EtherHiding. The worm implements persistence on macOS and Linux and includes a dead-man switch that polls the GitHub API every 60 seconds using the victim’s stolen token, clearing its state and exiting if the token is revoked. Some instances also self-clear after 24 hours.

Security vendors recommended that developers who installed any affected package version assume compromise. Recommended actions include removing the malware, rebuilding CI runners and build machines, revoking and rotating exposed credentials, and auditing GitHub repositories and workflows for unauthorized activity. JFrog advised isolating impacted systems and preserving package tarballs, npm and CI logs, GitHub audit logs, and runner images to bound the exposure window before cleanup. The incident follows a series of Mini Shai-Hulud supply-chain attacks that have repeatedly targeted the JavaScript ecosystem by abusing package publication flows and compromised developer credentials.