Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack

1. Executive summary

The "ChainDrop" campaign is a large-scale NPM supply chain attack in which a self-propagating credential-stealing worm — identified as a Mini Shai-Hulud variant — infected over 440 packages across multiple unrelated publishers, generating more than 2,200 malicious versions in under four hours. The attack began with the compromise of a maintainer's GitHub account for packages in the keyv and cacheable namespaces, and the worm subsequently auto-propagated by using stolen NPM tokens to republish every package accessible to compromised identities. EMEA financial services organisations with JavaScript/Node.js build pipelines that consumed affected packages — or whose developers installed them with lifecycle scripts enabled — should treat associated workstations, CI/CD runners, and all accessible secrets (NPM, GitHub, AWS, Kubernetes, HashiCorp Vault) as potentially compromised.

2. Regulatory framing

3. Technical analysis & attack chain

Initial access vector: Stolen maintainer credentials for the GitHub account of the publisher of packages in the keyv and cacheable NPM namespaces. The initial 11 malware carriers seeded the campaign.

Attack chain (confirmed steps)

1. Initial publisher compromise. The attacker obtained stolen credentials for a maintainer account associated with the keyv and cacheable namespaces. Evidence points to stolen maintainer credentials as the initial vector; no CVE is involved.
2. Malicious package publication. The attacker published modified package tarballs directly to the NPM registry — many malicious versions had no corresponding source-code commit, pull request, tag, or legitimate release, indicating direct tarball manipulation rather than source repository compromise.
3. Preinstall execution. Each infected package version contained a preinstall lifecycle script in package.json that launched a malicious file setup.mjs contained within the package. Because NPM runs preinstall scripts before installation completes, the payload executed on developer workstations and CI/CD build runners before application tests or conventional security checks began.
4. Second-stage payload delivery. setup.mjs downloaded the legitimate Bun JavaScript runtime alongside approximately 710 KB of heavily obfuscated second-stage JavaScript code representing the actual malware — a Mini Shai-Hulud variant.
5. Credential discovery and theft. The malware searched developer workstations and CI/CD environments for NPM, GitHub, AWS, Kubernetes, and HashiCorp Vault credentials. It used recovered identities to authenticate to these services and enumerate packages, repositories, workflow secrets, cloud parameters, and secret-store values.
6. Data exfiltration. Collected data was encrypted and transmitted to an attacker-controlled dynamic HTTPS endpoint. GitHub repositories served as a fallback exfiltration channel — attacker-created public GitHub repositories with the description "Shai-Hulud: Here We Go Again" were used for this purpose.
7. Self-propagation via NPM. After obtaining an NPM publishing token, the malware enumerated all packages available to the compromised identity, downloaded their latest tarballs, inserted the malware and setup loader, added a preinstall hook, incremented the patch version, and republished the modified packages. This transformed one compromised NPM identity into hundreds of malicious package releases — 2,212 malicious versions across 440 packages in under four hours.
8. Self-propagation via GitHub. The malware used stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path. In targeted workflows, it leveraged GitHub Actions OIDC publishing access.
9. Persistence and anti-forensics. On macOS and Linux, the worm installed a host-level dead-man's switch: it polled the GitHub API using the victim's stolen GitHub token every 60 seconds and deleted its state and exited if the token stopped working. The malware also self-cleared after 24 hours.
10. Command and control. The malware used an Ethereum blockchain for C2, a technique referred to as EtherHiding — an evolution from the Shai-Hulud 2.0 worm.

Affected package ecosystems: The initial packages were in the keyv and cacheable namespaces. Propagation infected packages associated with major enterprise software ecosystems including keyv, flat-cache, cache-manager, and others. Combined, the infected packages have over 500 million weekly downloads.

Attribution: No named threat actor with a confirmed MITRE profile has been identified in the available source material. Attribution is unconfirmed.

Confidence caveat: The technical detail above is corroborated across multiple sources (Microsoft Threat Intelligence, SecurityWeek, JFrog, StepSecurity, Socket). The EtherHiding/Ethereum C2 detail and the 24-hour self-clearing behaviour are single-sourced to Socket and BleepingComputer respectively; verify before enforcement.

4. Mitigation & containment

P1 — Within 24 hours

• Identify affected systems. Audit NPM install logs, CI/CD build logs, and package-lock.json files across all environments for packages in the keyv, cacheable, flat-cache, and cache-manager namespaces (and any of the 440+ affected packages). Cross-reference against published lists of malicious versions from Microsoft, JFrog, and Socket.
• Isolate affected workstations and build runners. Any system that installed an affected package version with lifecycle scripts enabled must be treated as compromised. Isolate from network immediately.
• Revoke and rotate all exposed credentials from a known-clean environment. This includes: NPM publishing tokens, GitHub personal access tokens and Actions secrets, AWS credentials, Kubernetes service account tokens, and HashiCorp Vault tokens. Do not rotate from affected machines.
• Preserve forensic evidence before cleanup. Preserve package tarballs, NPM logs, CI logs, GitHub audit logs, and runner images. These are needed to bound the exposure window.

P2 — Within 72 hours

• Disable NPM lifecycle scripts globally. Add --ignore-scripts to all NPM install commands in CI/CD pipelines and developer configurations. Set ignore-scripts=true in .npmrc files. This prevents preinstall hooks from executing.
• Audit GitHub repositories for anomalous activity. Check for unexpected commits, new configuration files (especially Claude or VS Code configuration files), modified workflow files, and unauthorised repository collaborator additions.
• Audit NPM publishing history. Review all packages owned by potentially compromised identities for unauthorised version publications. Look for patch-version increments with no corresponding source commit.
• Rebuild affected systems and downstream artefacts from trusted sources. Do not attempt to clean in place; rebuild CI runners and developer workstations from known-good images.
• Check for attacker-created GitHub repositories. Search GitHub for repositories with the description "Shai-Hulud: Here We Go Again" associated with compromised organisational accounts.

P3 — Within 7 days

• Implement package allowlisting. Restrict NPM installations to an allowlist of approved packages and versions. Use a private registry proxy (e.g., Artifactory, Nexus) with caching to prevent direct installation of newly published versions without review.
• Enforce 2FA on all NPM and GitHub maintainer accounts. Require hardware security keys for publishing access.
• Review GitHub Actions OIDC trust configurations. Ensure OIDC token permissions are narrowly scoped and cannot be abused for package publishing.
• Implement secret scanning. Deploy tools to detect credentials in CI/CD environment variables, .npmrc files, and build logs.

5. Indicators of compromise

file  setup.mjs
string  Shai-Hulud: Here We Go Again

Behavioural indicators

6. Detection

rule ChainDrop_Mini_ShaiHulud_NPM_Worm {
    meta:
        author = "Adverse Trace"
        date = "2026-08-05"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/"
        description = "Detects ChainDrop Mini Shai-Hulud NPM supply chain worm payload artefacts"
    strings:
        $setup_file = "setup.mjs" ascii
        $shai_hulud_desc = "Shai-Hulud: Here We Go Again" ascii
        $preinstall_hook = "preinstall" ascii
        $bun_runtime = "bun" ascii
    condition:
        2 of them
}

title: NPM Preinstall Hook Executing setup.mjs
id: at-2026-08-05-464-npm-preinstall-setup
status: experimental
description: Detects NPM preinstall lifecycle hook launching setup.mjs, consistent with ChainDrop supply chain attack
author: Adverse Trace
date: 2026/08/05
references:

    - https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/
logsource:
    product: linux
    category: process_creation
detection:
    selection:
        CommandLine|contains:

            - "npm"
            - "preinstall"
            - "setup.mjs"
    condition: selection
falsepositives:

    - Legitimate NPM packages using preinstall hooks with a setup.mjs file (rare)
level: high

title: GitHub API Polling at 60-Second Intervals with Stolen Token
id: at-2026-08-05-464-github-api-poll
status: experimental
description: Detects repeated GitHub API polling at 60-second intervals consistent with ChainDrop worm dead-man's switch
author: Adverse Trace
date: 2026/08/05
references:

    - https://www.securityweek.com/over-400-npm-packages-infected-in-chaindrop-supply-chain-attack/
logsource:
    product: proxy
    category: network_connection
detection:
    selection:
        DestinationHostname|contains:

            - "api.github.com"
        RequestMethod: "GET"
    timeframe: 5m
    condition: selection | count() > 4
falsepositives:

    - Legitimate CI/CD pipelines with frequent GitHub API polling
level: medium

7. Sources

• SecurityWeek — "Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack" — https://www.securityweek.com/over-400-npm-packages-infected-in-chaindrop-supply-chain-attack/ — 2026-08-05
• Microsoft Threat Intelligence — "ChainDrop supply chain compromise: Anatomy of a self-propagating worm" — https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/ — 2026-08-04
• SecurityWeek — "Multiple Jscrambler Packages Impacted by Supply Chain Attack" — https://www.securityweek.com/multiple-jscrambler-packages-impacted-by-supply-chain-attack/ — (date not specified)
• BleepingComputer — "New IronWorm malware hits 36 packages in npm supply-chain attack" — https://www.bleepingcomputer.com/news/security/new-ironworm-malware-hits-36-packages-in-npm-supply-chain-attack/ — (date not specified)
• The Hacker News — "TrapDoor Supply Chain Attack Spreads Credential-Stealing Malware via npm, PyPI, and CratesIO" — https://thehackernews.com/2026/05/trapdoor-supply-chain-attack-spreads.html — 2026-05
• Step Security — "Injective npm Supply Chain Attack: 18 Packages Backdoored to Steal Crypto Wallet Keys" — https://www.stepsecurity.io/blog/injective-npm-supply-chain-attack-18-packages-backdoored-to-steal-crypto-wallet-keys — (date not specified)
• BleepingComputer — "Injective SDK on npm infected with cryptocurrency wallet stealer" — https://www.bleepingcomputer.com/news/security/injective-sdk-on-npm-infected-with-cryptocurrency-wallet-stealer/ — (date not specified)

8. Adverse Trace position

This is a high-severity active supply chain attack with direct relevance to EMEA financial services organisations that build JavaScript/Node.js applications or maintain CI/CD pipelines consuming NPM packages. The worm's self-propagating design, combined with the massive download volume of affected packages (500M+ weekly downloads), means the blast radius is potentially very large. The malware's ability to access AWS, Kubernetes, and HashiCorp Vault credentials creates a direct path from developer workstation compromise to production infrastructure compromise. The 24-hour self-clearing behaviour and dead-man's switch make forensic scoping difficult — organisations must act quickly to preserve evidence before it is destroyed. Attribution is unconfirmed; no MITRE-profiled actor has been identified. Adverse Trace is monitoring for the full list of 440+ affected package names and versions, and will publish a supplementary IOC package once authoritative lists are released by Microsoft, JFrog, or Socket. Clients should immediately audit their NPM consumption for packages in the keyv, cacheable, flat-cache, and cache-manager namespaces and treat any matches as compromise incidents, not patching exercises.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.