New npm Supply-Chain Worm "ChainDrop" Automates Package Infections at Scale
A recently discovered npm supply-chain worm, dubbed ChainDrop, has compromised over 400 npm packages, including widely used projects like keyv and cacheable-request. The malware operates as an automated infection system, leveraging stolen developer credentials to propagate malicious code across the software supply chain.
How ChainDrop Works
Once executed on a developer’s workstation or CI/CD pipeline, ChainDrop scans for sensitive credentials, including:
- npm and GitHub publishing tokens
- Cloud credentials, SSH keys, and Docker/Kubernetes configurations
- Terraform state files and environment variables
Using stolen npm credentials, the worm identifies all packages the compromised account can publish, then rebuilds, injects malicious code, increments version numbers, and republishes them all while maintaining the original functionality to avoid detection.
Infection Mechanism & Evasion Tactics
ChainDrop modifies a package’s package.json file to include a preinstall hook that executes setup.mjs, a dropper script. The malware checks for the Bun JavaScript runtime, downloading it if absent, and uses it to run an obfuscated payload (mathinit.js). While Bun itself is not compromised, it is exploited as a portable execution environment.
Key evasion techniques include:
- Locale-based targeting: Exits on Russian-language systems, suggesting intentional geographic filtering.
- Memory scraping: A Python-based helper extracts GitHub Actions runner secrets and OpenID Connect tokens from live processes, capturing credentials that may never be written to disk.
- Persistence via developer tools: Creates malicious VS Code task files and Claude AI session hooks to re-execute the payload when projects are opened.
Researchers also identified dormant persistence mechanisms for macOS (LaunchAgent) and Linux (systemd user service), though these were not actively deployed in observed attacks.
Impact & Scope
ChainDrop’s automated propagation poses a severe risk to:
- Developers (compromised workstations)
- CI/CD pipelines (injected build processes)
- Cloud environments (exposed credentials)
- Downstream users (infected dependencies)
The worm’s ability to republish legitimate packages with hidden malicious updates makes detection challenging, as infected packages continue to function normally.
Indicators of Compromise (IOCs)
Security researchers have shared the following hashes for detection:
- Payloads:
- 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc (MathSymbol.js/mathinit.js)
- 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668 (setup.mjs – first variant)
- fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb (setup.mjs – second variant)
- b27b82afa5f15512f3856e549fb83d873fd0049759a4b62ce64c8d7d4dc2c678
Source: https://cyberpress.org/chaindrop-automates-npm-package-infections/
cacheable-request TPRM report: https://www.rankiteo.com/company/reversinglabs
npm TPRM report: https://www.rankiteo.com/company/npm-inc-
keyv TPRM report: https://www.rankiteo.com/company/socketinc
"id": "revsocnpm1786091119",
"linkid": "reversinglabs, socketinc, npm-inc-",
"type": "Cyber Attack",
"date": "8/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Software Development',
'name': 'keyv',
'type': 'npm package'},
{'industry': 'Software Development',
'name': 'cacheable-request',
'type': 'npm package'},
{'industry': 'Software Development',
'name': 'Other unnamed npm packages (~400 total)',
'type': 'npm package'}],
'attack_vector': 'Malicious npm package injection via stolen developer '
'credentials',
'data_breach': {'file_types_exposed': 'package.json, setup.mjs, mathinit.js, '
'VS Code task files, Claude AI session '
'hooks',
'sensitivity_of_data': 'High (authentication tokens, '
'infrastructure access credentials)',
'type_of_data_compromised': 'Credentials (npm/GitHub tokens, '
'cloud credentials, SSH keys), '
'environment variables, CI/CD '
'secrets, OpenID Connect tokens'},
'description': 'A recently discovered npm supply-chain worm, dubbed '
'ChainDrop, has compromised over 400 npm packages, including '
'widely used projects like keyv and cacheable-request. The '
'malware operates as an automated infection system, leveraging '
'stolen developer credentials to propagate malicious code '
'across the software supply chain.',
'impact': {'brand_reputation_impact': 'Potential reputational damage to '
'affected npm package maintainers and '
'downstream users',
'data_compromised': 'npm/GitHub tokens, cloud credentials, SSH '
'keys, Docker/Kubernetes configurations, '
'Terraform state files, environment variables, '
'GitHub Actions runner secrets, OpenID Connect '
'tokens',
'identity_theft_risk': 'High (stolen credentials and PII exposure)',
'operational_impact': 'Compromised software supply chain, '
'potential unauthorized access to cloud '
'environments, and infected dependencies in '
'downstream projects',
'systems_affected': 'Developer workstations, CI/CD pipelines, '
'cloud environments, downstream applications '
'using infected npm packages'},
'initial_access_broker': {'backdoors_established': 'Malicious preinstall '
'hooks, VS Code task '
'files, Claude AI session '
'hooks',
'entry_point': 'Stolen npm/GitHub publishing tokens',
'high_value_targets': 'npm packages with high '
'download counts (e.g., keyv, '
'cacheable-request)'},
'investigation_status': 'Ongoing',
'motivation': 'Credential theft, supply-chain compromise, and potential data '
'exfiltration',
'post_incident_analysis': {'corrective_actions': 'Rotate all compromised '
'credentials, enforce MFA '
'for npm publishing, audit '
'package.json files for '
'suspicious preinstall '
'hooks, and monitor for '
'unusual package updates.',
'root_causes': 'Stolen developer credentials, lack '
'of multi-factor authentication '
'(MFA) for npm publishing, '
'insufficient monitoring of package '
'version increments'},
'recommendations': 'Developers should audit npm packages for preinstall '
'hooks, rotate compromised credentials, monitor for '
'unusual package version increments, and use Bun runtime '
'cautiously in CI/CD environments.',
'references': [{'source': 'Cybersecurity Research Report'}],
'title': "New npm Supply-Chain Worm 'ChainDrop' Automates Package Infections "
'at Scale',
'type': 'Supply-Chain Attack',
'vulnerability_exploited': 'Stolen npm/GitHub publishing tokens, cloud '
'credentials, SSH keys, and CI/CD pipeline secrets'}