Security researchers are sounding the alarm over **ChainDrop**, a new self-propagating worm that has launched a major supply chain attack targeting the **npm** registry. The malware has infected more than 1,300 packages, some with billions of monthly downloads, including popular utilities like **Keyv**, **Cacheable**, **flat-cache**, and **file-entry-cache**. ### Attack Vector and Propagation The attack originated with the compromise of the GitHub account belonging to the maintainer of **Keyv**. This initial breach allowed the threat actor to push malicious code directly to the main branches of affected projects, subsequently generating new package releases. Crucially, because these packages were built and published via their legitimate GitHub Actions workflows, the compromised **npm** releases carried valid provenance information, making them harder to detect initially. Organizations such as **Deliveroo**, **Ornikar**, **OneReach**, **Picsart**, **Qlik**, and **ServiceTitan** have been identified as having packages associated with the compromised maintainer. ### The ChainDrop Payload Application security companies, including **Aikido**, **Wiz**, **StepSecurity**, **Socket**, and **Ox Security**, quickly identified the attack and the underlying **Shai-Hulud**-based worm, **ChainDrop**. **Aikido** reports that at least 868 packages across 1,381 versions have been compromised. Poisoned packages contain two primary malicious files: * `setup.mjs`: The payload dropper. * `Math_Symbol.js` (or `math_init.js`): The infostealer script. These packages also include a `"preinstall": "node setup.mjs"` entry in their `package.json` configuration. This ensures that `setup.mjs` executes automatically whenever `npm install` is run against an affected version. ### Infostealer Capabilities The `setup.mjs` dropper downloads the **Bun** JavaScript runtime from its official GitHub release to execute the `Math_Symbol.js` infostealer. After execution, the temporary runtime directory is deleted to cover tracks. **Aikido** researchers observed that the infostealer collects developer and cloud credentials from the compromised environment, encrypts them, and then exfiltrates them to a public GitHub repository. This repository is notably described as "**Shai-Hulud**: Here We Go Again."  Before exfiltrating any token, the malware validates it in real-time against `registry.npmjs[.]org/-/whoami`. The highly obfuscated malicious JavaScript also incorporates self-spreading capabilities, enabling it to infect packages maintained by others if they have used a previously compromised package. ### Data Exfiltration and Indicators of Compromise The malware aggressively searches infected development systems and CI/CD runners for credentials that could grant access to additional source code repositories and **npm** packages. The stolen data types are extensive and include: * Complete process environment data. * Local configuration and credential files. * GitHub PATs, workflow tokens, and other `ghp_`, `gho_`, and `ghs_` tokens. * **npm** tokens starting with `npm_`. * GitHub Actions secrets (specifically `"isSecret":true` values from self-hosted runners). * AWS credentials, SSM Parameter Store values, and Secrets Manager secrets. * Kubernetes secrets from accessible namespaces. * HashiCorp Vault tokens and KV secrets. * Database credentials, private keys, and credentials for services like **Stripe**, **Slack**, **Twilio**, **Azure**, and **GCP**. **Wiz** identifies the domain `npm-cache[.]com` as being used for data exfiltration, marking it as a strong indicator of compromise. ### Remediation and Prevention System administrators are advised to treat any developer workstation or CI/CD runner that installed an affected package version as compromised, even if the package was subsequently removed. Recommended actions include: * Rebuilding systems from safe backups or from scratch. * Rotating all tokens accessible from the impacted environment. * Reviewing logs for unauthorized access and repositories for unexpected commits or changes. As the attack is still unfolding, the number of compromised packages and malicious versions is expected to grow. Continuous vigilance, including the use of dependency allowlisting, integrity checks, and provenance controls, is critical. Comprehensive lists of compromised **npm** packages and indicators of compromise (including hashes for malicious files and network data) are available from the security firms actively tracking this threat: **Wiz**, **StepSecurity**, **Aikido**, **Socket**, and **Ox Security**.