ChainDrop Worm Infects 1,300 npm Packages, Affecting 2 Billion Monthly Downloads
A sophisticated self-propagating malware attack leveraged stolen maintainer tokens to automate the infection of the JavaScript ecosystem.
A massive supply-chain attack dubbed "ChainDrop" has compromised more than 1,300 npm packages, impacting an ecosystem with approximately 2 billion monthly downloads. The incident marks a shift toward automated, worm-like propagation within developer toolchains, turning legitimate package updates into delivery vehicles for credential-stealing malware.
The attack originated from the compromise of the GitHub account belonging to the maintainer of the 'keyv' library. Once inside, the malware deployed a two-stage payload: a dropper named 'setup.mjs' that downloads the Bun runtime, followed by a primary infostealer identified as 'Math_Symbol.js' or 'math_init.js'. According to researchers at Aikido, any user who ran `npm install` against an affected version would have had the 'setup.mjs' script execute automatically before the installation process completed.
The Mechanics of Propagation
Unlike traditional supply-chain attacks that rely on a single point of failure, ChainDrop functioned as a worm. The malware harvested npm and GitHub tokens from infected environments and used those stolen credentials to automatically bump patch versions and inject malicious code into other packages the tokens had permission to publish. This allowed the infection to spread rapidly across the ecosystem, targeting widely used caching utilities such as flat-cache and file-entry-cache to maximize its initial footprint. The attackers further expanded their reach by targeting organizations including Qlik, Picsart, and Deliveroo.
Industry Implications
This incident demonstrates a high level of technical agility and operational security. By utilizing the Bun runtime, the attackers were able to bypass certain security detections that typically monitor standard Node.js environments. Furthermore, the malware targeted specific developer tools, such as injecting hooks into `.claude/settings.json` to ensure automatic execution during Claude Code sessions. The exfiltration method was equally unconventional; stolen data was sent to the domain 'npm-cache[.]com' or uploaded to public GitHub repositories bearing the description "Shai-Hulud: Here We Go Again."
Future Risks for CI/CD
The use of legitimate GitHub Actions workflows to publish poisoned versions with valid provenance makes this attack particularly difficult to detect using standard checksums or signature verification. As the malware actively uses stolen credentials to automate the infection of further targets, it poses a severe systemic risk to CI/CD pipelines and developer workstations globally. Security teams are now tasked with auditing not only their direct dependencies but also the integrity of the tokens stored within their build environments to prevent similar automated propagation events.