ChainDrop npm Attack Infects Hundreds of Packages
▼ Summary
– The ‘ChainDrop’ worm compromised over 1,300 npm packages with 2 billion monthly downloads, including popular caching utilities like Keyv and Cacheable, after hijacking a maintainer’s GitHub account.
– Malicious files were pushed to main branches and published via legitimate GitHub Actions workflows, so the compromised npm releases carried valid provenance information.
– The attack used a setup.mjs dropper that downloaded the Bun runtime to execute an obfuscated infostealer script, which collected cloud and developer credentials and exfiltrated them to a public GitHub repository.
– The malware self-propagated by infecting packages from other maintainers who used compromised packages, and it targeted credentials like GitHub tokens, npm tokens, AWS secrets, and Kubernetes secrets from infected systems and CI/CD runners.
– Security firms advise treating affected systems as fully compromised, rebuilding from backups, rotating all accessible tokens, and using dependency allowlisting and integrity checks, as the attack is ongoing and package numbers may grow.
A self-replicating malware strain dubbed ChainDrop has swept through the npm registry, compromising over 1,300 packages that collectively account for roughly 2 billion downloads each month. The attack has hit widely used caching libraries, including Keyv, Cacheable, flat-cache, and file-entry-cache, all maintained by the same developer.
The campaign began when the attacker seized control of the GitHub account belonging to Keyv’s maintainer. From there, the infection jumped to packages tied to major firms such as Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan. Security teams from multiple vendors flagged the incident, tracing it to a worm based on the Shai-Hulud framework.
According to a report from Aikido, “at least 868 packages (across 1381 versions) have been compromised by the worm.” The researchers observed that malicious files were pushed directly to the main branches of affected projects, followed by the creation of new package releases. Because the builds and publications flowed through the projects’ legitimate GitHub Actions workflows, the poisoned npm versions carried valid provenance metadata.
Each compromised package includes two core components: a dropper file named setup.mjs and an infostealer script called Math_Symbol.js. The package.json configuration also contains a `”preinstall”: “node setup.mjs”` entry, meaning the malware executes automatically during installation.
“Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed,” the Aikido researchers warned.
The dropper fetches the Bun JavaScript runtime from its official GitHub release and uses it to run the malicious script. Specifically, it executes `execFileSync(, [‘<scriptdir>/MathSymbol.js’], { stdio: ‘inherit’, cwd: })`. After the infostealer runs, setup.mjs removes the temporary runtime directory to cover its tracks.
Aikido’s analysis shows the infostealer harvests developer and cloud credentials from the compromised environment, encrypts the stolen data, and exfiltrates it to a public GitHub repository labeled “Shai-Hulud: Here We Go Again.” The JavaScript is heavily obfuscated and includes self-propagation routines that allow it to spread to packages from other maintainers who depend on an already infected package.
While Aikido identified the Bun-launched MathSymbol.js, BleepingComputer also observed compromised npm packages carrying a variant called mathinit.js. Before any token is stolen, the malware validates it in real time against `registry.npmjs[.]org/-/whoami`.
The worm scans infected developer machines and CI/CD runners for credentials that could unlock further repositories and npm packages. The data it collects spans a wide range, including the full process environment, local configuration and credential files, GitHub PATs and workflow tokens (formats `ghp`, `gho`, `ghs`), npm tokens beginning with `npm`, GitHub Actions secrets (including logic to extract `”isSecret”:true` values from self-hosted runners), AWS credentials, SSM Parameter Store values using `WithDecryption: true`, Secrets Manager secrets, Kubernetes secrets from accessible namespaces, HashiCorp Vault tokens and KV secrets, plus database credentials, private keys, and tokens for Stripe, Slack, Twilio, Azure, and GCP.
Cloud security firm Wiz flagged the domain `npm-cache[.]com` as an active exfiltration endpoint, urging defenders to treat its presence as a strong compromise indicator.
If an affected package version was ever installed, administrators should assume the developer workstation or CI/CD runner is fully compromised, even if the package was later removed. Recommended steps include rebuilding systems from clean backups or from scratch, rotating every token that was accessible from the impacted environment, and auditing logs for unauthorized access or unexpected repository changes.
Since the attack is ongoing, the list of affected packages and malicious versions will likely grow. Security teams should continue enforcing dependency allowlisting, integrity verification, and provenance controls to limit exposure.
Detailed lists of compromised packages are available from Wiz, StepSecurity, Aikido, Socket, and Ox Security. These vendors also publish indicators of compromise, including file hashes, artifact identifiers, and network telemetry.
(Source: BleepingComputer)
