ChainDrop Worm Compromises Over 1,300 npm Packages in Massive Supply-Chain Attack
A self-propagating worm dubbed ChainDrop compromises over 1,300 packages on the npm registry, targeting popular caching utilities like Keyv and Cacheable. The attack originates after threat actors breach the GitHub account of a prominent package maintainer, allowing the worm to push malicious code directly to main project branches. Because the poisoned packages publish through legitimate GitHub Actions workflows, they carry valid provenance information that makes detection significantly more difficult.
Once a developer runs npm install on an affected version, the malware executes automatically through a payload dropper called setup.mjs. This dropper downloads the Bun JavaScript runtime to run an obfuscated infostealer script known as Math_Symbol.js, which then harvests developer and cloud credentials from the compromised environment. The stolen data is encrypted and uploaded to a public GitHub repository before the malware cleans up its temporary files to avoid suspicion.
What makes ChainDrop particularly dangerous is its ability to self-propagate across unrelated packages. When a project depends on a compromised package, the worm infects that project's code and publishes new malicious versions. Multiple application security firms identify the malware as based on the Shai-Hulud framework. Organizations linked to affected packages include major companies such as Deliveroo, Picsart, Qlik, and ServiceTitan, highlighting the broad reach and potential impact of this supply-chain attack.