ChainDrop Worm Infects 400+ npm Packages to Steal GitHub and Cloud Credentials

ChainDrop has turned routine software installs into a route for credential theft. The self-propagating worm infected more than 400 npm packages, putting developer laptops, build systems and cloud environments at risk.

Since compromised packages still work as expected, teams may not realize an update has opened a path into their environment.

The campaign spreads through trusted publishing accounts. A poisoned package runs during installation, searches for valuable access tokens, and uses stolen npm credentials to alter and republish further packages.

That automated cycle lets one compromised developer or build runner affect many downstream users.

Unit 42 said in a report shared with Cyber Security News (CSN) that the operation has touched packages downloaded hundreds of millions of times each week.

Researchers found 453 public repositories across five accounts matching the worm’s data-theft pattern, although those accounts remain possible rather than confirmed victims.

The incident underscores the danger of software supply chain attacks. Rather than use fake websites or email lures, attackers abuse the trust developers place in package registries, release automation and familiar open-source dependencies.

The threat can cross from code projects into cloud accounts and production pipelines.

ChainDrop Worm Infects 400+ npm Packages

ChainDrop hides inside otherwise legitimate package releases. Researchers found an infected package adds an install-time instruction, a dropper and an obfuscated payload while leaving the original code intact.

This low-profile approach helps the altered release appear normal to developers and review processes.

After installation, the malware can run quietly on a workstation or within a continuous integration job. It collects npm and GitHub tokens, cloud credentials, SSH keys, environment files and developer-tool configuration data.

It also targets temporary secrets held in GitHub Actions runner memory, reaching information that may never be saved as a normal file.

The worm then uses publishing tokens to identify packages a compromised account can update, adds malicious components, increases the patch version and republishes them.

This resembles related npm worm coverage, where a trusted update channel becomes the delivery mechanism rather than an obvious malicious download.

It also creates persistence in project settings for code editors and AI-assisted development tools. Opening a project can therefore trigger the malware after the original installation.

That risk mirrors AI tool backdoor incidents, where local configuration becomes an unexpected execution point.

Credential Theft and Containment Steps

ChainDrop does more than collect secrets. It can create public repositories under victim accounts as an additional route for stolen data.

It also retrieves its command destination through an Ethereum smart contract, letting the operator change the destination without updating infected packages. The researchers observed such a change on August 4.

This design complicates a simple block-and-move-on response. An organization may stop one network route yet miss the repository-based channel, compromised lockfiles, cached archives or infected build images.

Teams should review unexpected npm publishing and repository changes, particularly after dependency updates or unusual automated releases.

Unit 42 recommends locating and removing affected package versions, investigating developer machines and CI runners, and removing persistence before rotating credentials.

Security teams should revoke and replace npm, GitHub, cloud, SSH and automation secrets exposed on confirmed infected systems.

Recent Keyv package compromise coverage shows why installation during the exposure period deserves the same urgency as a credential incident.

Administrators should rebuild dependency lockfiles from trusted releases and clear old caches, mirrors and package archives. Updating a latest tag alone may not protect systems that already resolved a poisoned version.

Teams can reduce exposure with short-lived, narrowly scoped credentials, single-use CI runners and strict outbound network rules for build jobs.

Finally, defenders should inspect package changes for new install hooks, altered script sections and unusually large compressed JavaScript files.

They should hunt across repositories and build environments, not only named packages, because the worm expands through every account where it finds publishing access.

The broader cloud services package compromise illustrates how stolen release credentials can turn a limited breach into a widespread supply-chain event.

Indicators of Compromise (IoCs):-

Type	Indicator	Description
SHA-256	9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc	Hash for Math_Symbol.js / math_init.js
SHA-256	54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668	Hash for first setup.mjs variant
SHA-256	fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb	Hash for second setup.mjs variant
SHA-256	b27b82afa5f15512f3856e549fb83d873fd0049759a4b62ce64c8d7d4dc2c678	Hash for setup.mjs.malicious
Domain	awqhnjewqjkl[.]icu	C2 domain retrieved through the Ethereum resolver contract
Domain	npm-cache[.]com	C2 domain active during analysis
Domain	pypi-get[.]com	Historical C2 domain returned by the Ethereum contract
Domain	js-mirror[.]com	Historical C2 domain returned by the Ethereum contract
URL	hxxps://npm-cache[.]com:443/router	C2 data-exfiltration endpoint
URL	hxxp://awqhnjewqjkl[.]icu/cdn-cgi/rum?	Observed endpoint associated with the rotated C2 domain
IP address	104.21.91[.]101	Destination IP address observed for the rotated C2 domain
IP address	172.67.215[.]154	Destination IP address observed for the rotated C2 domain
Ethereum contract	0xE1f2395ee43e45A1556EC6438a88c31B83493103	Resolver contract used to supply C2 domains
Ethereum transaction	0xc55920f1bd0531b6738153068a666c080ddded47e6256f1fd980d51c0b507c91	Transaction used to rotate C2 infrastructure
Ethereum wallet	0x55f9780e1492344b7417fa723aedc4d0b97f31cd	Contract owner wallet
Ethereum wallet	0x35477b7b2df3174B9FE8A681750A7E3fbA20F39B	Binance deposit pivot
Ethereum selector	0x53ed5143	Getter selector
Ethereum selector	0xd3c159e5	Setter selector
Repository description	Shai-Hulud: Here We Go Again	Description used on public repositories linked to exfiltration activity
GitHub marker	thebeautifulmarchoftime	Commit-search token used for the backup C2 mechanism
GitHub marker	thebeautifulsnadsoftime	Signed-record prefix for the backup C2 mechanism
Name terms	sardaukar, mentat, fremen, atreides, harkonnen	Dune-themed terms used in generated repository names
File path	~/.local/bin/gh-token-monitor.sh	Latent Linux persistence artifact
File path	~/.config/gh-token-monitor/	Latent Linux persistence directory
File path	~/Library/LaunchAgents/com.user.gh-token-monitor.plist	Latent macOS LaunchAgent persistence artifact
File path	~/.config/systemd/user/gh-token-monitor.service	Latent Linux systemd persistence artifact

tionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world