> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack - URL: https://f4n6.co.uk/security-feed/over-400-npm-packages-infected-in-chaindrop-supply-chain-attack/ - Published: 2026-08-05T10:30:47.000Z - Updated: 2026-08-05T10:30:47.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary The "ChainDrop" campaign is a large-scale NPM supply chain attack in which a self-propagating credential-stealing worm — identified as a Mini Shai-Hulud variant — infected over 440 packages across multiple unrelated publishers, generating more than 2,200 malicious versions in under four hours. The attack began with the compromise of a maintainer's GitHub account for packages in the `keyv` and `cacheable` namespaces, and the worm subsequently auto-propagated by using stolen NPM tokens to republish every package accessible to compromised identities. EMEA financial services organisations with JavaScript/Node.js build pipelines that consumed affected packages — or whose developers installed them with lifecycle scripts enabled — should treat associated workstations, CI/CD runners, and all accessible secrets (NPM, GitHub, AWS, Kubernetes, HashiCorp Vault) as potentially compromised. ## 2\. Regulatory framing | Article | Trigger (the fact in this item) | Practical impact | | ------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | DORA Art. 17: ICT-related incident management process | Self-propagating worm exfiltrates credentials from developer workstations and CI/CD systems, constituting an ICT-related incident requiring a structured detection, containment, and recovery process. | Clients must activate incident management procedures: isolate affected build systems, preserve logs for scoping, and execute credential rotation from known-clean environments. | | DORA Art. 19: reporting of major ICT-related incidents to competent authorities | Worm accesses cloud infrastructure credentials (AWS, Kubernetes, HashiCorp Vault) and can enumerate secret-store values, potentially meeting major-incident thresholds if production access was achieved. | Clients must assess whether credential exposure and potential cloud infrastructure access crosses the major-incident reporting threshold and notify competent authorities accordingly. | | NIS2 Art. 21(2)(d): supply chain security measures | Attack vector is a compromised open-source software dependency propagated through the NPM registry, directly engaging supply chain security obligations. | Clients must review and tighten dependency management controls, including disabling npm lifecycle scripts by default and enforcing allowlists for package installation in build environments. | ## 3\. Technical analysis & attack chain **Initial access vector:** Stolen maintainer credentials for the GitHub account of the publisher of packages in the `keyv` and `cacheable` NPM namespaces. The initial 11 malware carriers seeded the campaign. ### Attack chain (confirmed steps) 1. **Initial publisher compromise.** The attacker obtained stolen credentials for a maintainer account associated with the `keyv` and `cacheable` namespaces. Evidence points to stolen maintainer credentials as the initial vector; no CVE is involved. 2. **Malicious package publication.** The attacker published modified package tarballs directly to the NPM registry — many malicious versions had no corresponding source-code commit, pull request, tag, or legitimate release, indicating direct tarball manipulation rather than source repository compromise. 3. **Preinstall execution.** Each infected package version contained a `preinstall` lifecycle script in `package.json` that launched a malicious file `setup.mjs` contained within the package. Because NPM runs `preinstall` scripts before installation completes, the payload executed on developer workstations and CI/CD build runners before application tests or conventional security checks began. 4. **Second-stage payload delivery.** `setup.mjs` downloaded the legitimate Bun JavaScript runtime alongside approximately 710 KB of heavily obfuscated second-stage JavaScript code representing the actual malware — a Mini Shai-Hulud variant. 5. **Credential discovery and theft.** The malware searched developer workstations and CI/CD environments for NPM, GitHub, AWS, Kubernetes, and HashiCorp Vault credentials. It used recovered identities to authenticate to these services and enumerate packages, repositories, workflow secrets, cloud parameters, and secret-store values. 6. **Data exfiltration.** Collected data was encrypted and transmitted to an attacker-controlled dynamic HTTPS endpoint. GitHub repositories served as a fallback exfiltration channel — attacker-created public GitHub repositories with the description "Shai-Hulud: Here We Go Again" were used for this purpose. 7. **Self-propagation via NPM.** After obtaining an NPM publishing token, the malware enumerated all packages available to the compromised identity, downloaded their latest tarballs, inserted the malware and setup loader, added a `preinstall` hook, incremented the patch version, and republished the modified packages. This transformed one compromised NPM identity into hundreds of malicious package releases — 2,212 malicious versions across 440 packages in under four hours. 8. **Self-propagation via GitHub.** The malware used stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path. In targeted workflows, it leveraged GitHub Actions OIDC publishing access. 9. **Persistence and anti-forensics.** On macOS and Linux, the worm installed a host-level dead-man's switch: it polled the GitHub API using the victim's stolen GitHub token every 60 seconds and deleted its state and exited if the token stopped working. The malware also self-cleared after 24 hours. 10. **Command and control.** The malware used an Ethereum blockchain for C2, a technique referred to as EtherHiding — an evolution from the Shai-Hulud 2.0 worm. **Affected package ecosystems:** The initial packages were in the `keyv` and `cacheable` namespaces. Propagation infected packages associated with major enterprise software ecosystems including `keyv`, `flat-cache`, `cache-manager`, and others. Combined, the infected packages have over 500 million weekly downloads. **Attribution:** No named threat actor with a confirmed MITRE profile has been identified in the available source material. Attribution is unconfirmed. **Confidence caveat:** The technical detail above is corroborated across multiple sources (Microsoft Threat Intelligence, SecurityWeek, JFrog, StepSecurity, Socket). The EtherHiding/Ethereum C2 detail and the 24-hour self-clearing behaviour are single-sourced to Socket and BleepingComputer respectively; verify before enforcement. ## 4\. Mitigation & containment ### P1 — Within 24 hours - **Identify affected systems.** Audit NPM install logs, CI/CD build logs, and package-lock.json files across all environments for packages in the `keyv`, `cacheable`, `flat-cache`, and `cache-manager` namespaces (and any of the 440+ affected packages). Cross-reference against published lists of malicious versions from Microsoft, JFrog, and Socket. - **Isolate affected workstations and build runners.** Any system that installed an affected package version with lifecycle scripts enabled must be treated as compromised. Isolate from network immediately. - **Revoke and rotate all exposed credentials from a known-clean environment.** This includes: NPM publishing tokens, GitHub personal access tokens and Actions secrets, AWS credentials, Kubernetes service account tokens, and HashiCorp Vault tokens. Do not rotate from affected machines. - **Preserve forensic evidence before cleanup.** Preserve package tarballs, NPM logs, CI logs, GitHub audit logs, and runner images. These are needed to bound the exposure window. ### P2 — Within 72 hours - **Disable NPM lifecycle scripts globally.** Add `--ignore-scripts` to all NPM install commands in CI/CD pipelines and developer configurations. Set `ignore-scripts=true` in `.npmrc` files. This prevents `preinstall` hooks from executing. - **Audit GitHub repositories for anomalous activity.** Check for unexpected commits, new configuration files (especially Claude or VS Code configuration files), modified workflow files, and unauthorised repository collaborator additions. - **Audit NPM publishing history.** Review all packages owned by potentially compromised identities for unauthorised version publications. Look for patch-version increments with no corresponding source commit. - **Rebuild affected systems and downstream artefacts from trusted sources.** Do not attempt to clean in place; rebuild CI runners and developer workstations from known-good images. - **Check for attacker-created GitHub repositories.** Search GitHub for repositories with the description "Shai-Hulud: Here We Go Again" associated with compromised organisational accounts. ### P3 — Within 7 days - **Implement package allowlisting.** Restrict NPM installations to an allowlist of approved packages and versions. Use a private registry proxy (e.g., Artifactory, Nexus) with caching to prevent direct installation of newly published versions without review. - **Enforce 2FA on all NPM and GitHub maintainer accounts.** Require hardware security keys for publishing access. - **Review GitHub Actions OIDC trust configurations.** Ensure OIDC token permissions are narrowly scoped and cannot be abused for package publishing. - **Implement secret scanning.** Deploy tools to detect credentials in CI/CD environment variables, `.npmrc` files, and build logs. ## 5\. Indicators of compromise | Type | Value | Confidence | Source | | --------- | -------------------------------------------------------------- | ---------- | ------------------------ | | file | setup.mjs | High | Microsoft / SecurityWeek | | string | Shai-Hulud: Here We Go Again (GitHub repo description) | High | SecurityWeek / Socket | | behaviour | NPM preinstall hook launching setup.mjs | High | Microsoft | | behaviour | Polling GitHub API every 60 seconds with stolen token | Medium | Socket | | behaviour | Self-clearing after 24 hours | Medium | Socket | | behaviour | Injecting Claude/VS Code configuration files into GitHub repos | High | Microsoft | | behaviour | Downloading Bun runtime + \~710 KB obfuscated JS payload | High | SecurityWeek / Microsoft | ```iocs file setup.mjs string Shai-Hulud: Here We Go Again ``` ### Behavioural indicators | Behaviour | Where to observe | Confidence | | ------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------- | ---------- | | NPM preinstall lifecycle hook executing setup.mjs | NPM install logs, CI/CD build logs, process monitoring on developer workstations | High | | Download of Bun JavaScript runtime during package installation | Egress proxy logs, network flow logs from build runners | High | | Encrypted HTTPS exfiltration to dynamic endpoint | Egress proxy logs, network flow logs | High | | GitHub API polling at 60-second intervals using organisational tokens | GitHub audit logs, egress proxy logs | Medium | | Creation of public GitHub repositories with description "Shai-Hulud: Here We Go Again" | GitHub audit logs, GitHub API monitoring | High | | Unauthorised NPM package version publications with patch-version increments and no source commits | NPM registry audit, package release history | High | | Injection of Claude or VS Code configuration files into repositories | GitHub commit history, repository audit | High | | Self-deletion of malware state and exit upon token revocation | EDR process monitoring, host forensic artefacts | Medium | ## 6\. Detection ```yara rule ChainDrop_Mini_ShaiHulud_NPM_Worm { meta: author = "Adverse Trace" date = "2026-08-05" reference = "https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/" description = "Detects ChainDrop Mini Shai-Hulud NPM supply chain worm payload artefacts" strings: $setup_file = "setup.mjs" ascii $shai_hulud_desc = "Shai-Hulud: Here We Go Again" ascii $preinstall_hook = "preinstall" ascii $bun_runtime = "bun" ascii condition: 2 of them } ``` ```yaml title: NPM Preinstall Hook Executing setup.mjs id: at-2026-08-05-464-npm-preinstall-setup status: experimental description: Detects NPM preinstall lifecycle hook launching setup.mjs, consistent with ChainDrop supply chain attack author: Adverse Trace date: 2026/08/05 references: - https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/ logsource: product: linux category: process_creation detection: selection: CommandLine|contains: - "npm" - "preinstall" - "setup.mjs" condition: selection falsepositives: - Legitimate NPM packages using preinstall hooks with a setup.mjs file (rare) level: high ``` ```yaml title: GitHub API Polling at 60-Second Intervals with Stolen Token id: at-2026-08-05-464-github-api-poll status: experimental description: Detects repeated GitHub API polling at 60-second intervals consistent with ChainDrop worm dead-man's switch author: Adverse Trace date: 2026/08/05 references: - https://www.securityweek.com/over-400-npm-packages-infected-in-chaindrop-supply-chain-attack/ logsource: product: proxy category: network_connection detection: selection: DestinationHostname|contains: - "api.github.com" RequestMethod: "GET" timeframe: 5m condition: selection | count() > 4 falsepositives: - Legitimate CI/CD pipelines with frequent GitHub API polling level: medium ``` ## 7\. Sources - SecurityWeek — "Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack" — https://www.securityweek.com/over-400-npm-packages-infected-in-chaindrop-supply-chain-attack/ — 2026-08-05 - Microsoft Threat Intelligence — "ChainDrop supply chain compromise: Anatomy of a self-propagating worm" — https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/ — 2026-08-04 - SecurityWeek — "Multiple Jscrambler Packages Impacted by Supply Chain Attack" — https://www.securityweek.com/multiple-jscrambler-packages-impacted-by-supply-chain-attack/ — (date not specified) - BleepingComputer — "New IronWorm malware hits 36 packages in npm supply-chain attack" — https://www.bleepingcomputer.com/news/security/new-ironworm-malware-hits-36-packages-in-npm-supply-chain-attack/ — (date not specified) - The Hacker News — "TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO" — https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html — 2026-05 - Step Security — "Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys" — https://www.stepsecurity.io/blog/injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys — (date not specified) - BleepingComputer — "Injective SDK on npm infected with cryptocurrency wallet stealer" — https://www.bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer/ — (date not specified) ## 8\. Adverse Trace position This is a **high-severity** active supply chain attack with direct relevance to EMEA financial services organisations that build JavaScript/Node.js applications or maintain CI/CD pipelines consuming NPM packages. The worm's self-propagating design, combined with the massive download volume of affected packages (500M+ weekly downloads), means the blast radius is potentially very large. The malware's ability to access AWS, Kubernetes, and HashiCorp Vault credentials creates a direct path from developer workstation compromise to production infrastructure compromise. The 24-hour self-clearing behaviour and dead-man's switch make forensic scoping difficult — organisations must act quickly to preserve evidence before it is destroyed. Attribution is unconfirmed; no MITRE-profiled actor has been identified. Adverse Trace is monitoring for the full list of 440+ affected package names and versions, and will publish a supplementary IOC package once authoritative lists are released by Microsoft, JFrog, or Socket. Clients should immediately audit their NPM consumption for packages in the `keyv`, `cacheable`, `flat-cache`, and `cache-manager` namespaces and treat any matches as compromise incidents, not patching exercises. --- [Read the original source →](https://www.securityweek.com/over-400-npm-packages-infected-in-chaindrop-supply-chain-attack/?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*