ChainDrop Worm Exploits npm Ecosystem

Compromise of the npm Ecosystem

A sophisticated supply-chain attack identified as ChainDrop has infiltrated the Node Package Manager (npm) registry. The campaign, which functions as a self-propagating worm, has impacted more than 1,300 packages. These compromised dependencies represent a significant security risk due to their widespread integration into development environments, with a combined total of 2 billion monthly downloads.

The incident originated from the compromise of a specific GitHub account belonging to the maintainer of the Keyv project. By gaining unauthorized access, the threat actor was able to inject malicious code directly into the projects’ main branches. Subsequent package releases were generated through legitimate GitHub Actions workflows, which allowed the malicious updates to carry valid provenance information, potentially bypassing standard security filters that rely on verified build sources.

Mechanics of the Worm

The attack utilizes a dual-file payload structure designed to execute automatically upon package installation. Infected projects include a modified package.json configuration file containing a preinstall script that triggers the execution of setup.mjs. This dropper script is responsible for downloading the Bun JavaScript runtime from official sources, which is then used to execute the second component, Math_Symbol.js, an obfuscated infostealer.

Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed.

— Aikido researchers

Once active, the malware performs real-time validation of stolen credentials against the npm registry. The Math_Symbol.js script—also observed as math_init.js in some instances—is designed to search development systems and CI/CD runners for high-value data. The setup.mjs script concludes its operation by removing the temporary runtime directory, attempting to minimize the footprint left on the host system.

Scope of Data Exfiltration

The infostealer is engineered to harvest a broad array of sensitive information from compromised environments. The malware targets the complete process environment and local configuration files, prioritizing credentials that grant access to further infrastructure. This includes:

• GitHub Personal Access Tokens (PATs) and workflow tokens
• npm tokens and GitHub Actions secrets
• AWS credentials, SSM Parameter Store values, and Secrets Manager secrets
• Kubernetes secrets, HashiCorp Vault tokens, and KV secrets
• Database credentials, private keys, and API keys for services like Stripe, Slack, Twilio, Azure, and GCP

Data exfiltration is directed to a public GitHub repository titled "Shai-Hulud: Here We Go Again," while the domain npm-cache.com has also been identified as a secondary channel for moving stolen data.

Impacted Package Ecosystem

The reach of the attack extends to packages utilized by major organizations, including Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan. The infection is not limited to a single set of utilities; it encompasses popular caching tools such as Keyv, Cacheable, flat-cache, and file-entry-cache. Research indicates that at least 868 packages across 1,381 versions have been affected by the worm.

Mitigation and Recovery

Security experts advise that any system where an affected package version was installed must be considered fully compromised. Simply removing the malicious package is insufficient to restore the integrity of the environment. Organizations are urged to rebuild affected systems from secure backups or initiate fresh deployments. Furthermore, all tokens, keys, and secrets that were accessible from the impacted workstation or CI/CD runner must be rotated immediately.

Ongoing vigilance is required as the campaign continues to evolve. Security teams should prioritize the implementation of dependency allowlisting and rigorous integrity checks. For further technical details and indicators of compromise, organizations can consult resources provided by Wiz, StepSecurity, and Aikido.

Implications for Infrastructure

This incident underscores the fragility of automated CI/CD pipelines when trust is placed in the provenance of upstream dependencies. Because the attacker utilized legitimate GitHub Actions to publish the tainted releases, the attack highlights a gap in traditional supply-chain security that relies heavily on automated verification. For organizations, the risk is not merely the presence of a single malicious file, but the potential for lateral movement and the loss of long-term administrative access to cloud and database infrastructure. The automated nature of the worm suggests that development environments are increasingly becoming the primary targets for large-scale credential harvesting, necessitating a shift toward more granular isolation of CI/CD secrets.