ChainDrop Worm Compromises Hundreds of npm Packages to Steal Credentials and Spread
Summary
A worm dubbed ChainDrop compromised hundreds of npm packages, including widely used projects. Its payload can collect credentials and cloud secrets, exfiltrate data, and spread through npm packages and GitHub repositories.
Key points
- The campaign began on August 4, 2026, with malicious commits affecting packages including keyv, Cacheable-family packages, and ecto; some affected packages have over 150 million weekly downloads.
- A malicious preinstall script runs a loader that starts an obfuscated second-stage payload under Bun, including when the package is installed without being imported by an application.
- The payload targets files, environment variables, GitHub Actions runner memory, and secrets in AWS, Kubernetes, and Vault.
- Collected data is encrypted and sent to a domain retrieved through an Ethereum smart-contract dead drop; a GitHub repository can serve as an exfiltration fallback.
- The malware can use stolen credentials to publish infected npm packages and add hooks or workflows to GitHub repositories, enabling further spread and secret theft.
- A command-and-control response can provide code for execution in the payload, creating an additional remote code-execution capability.
- The article provides affected-package information and indicators of compromise, including file hashes, network indicators, and persistence-related paths.
Article Details
- Attack Vectors
- Compromised npm packages execute setup.mjs through a preinstall lifecycle script, which starts the second-stage payload under Bun.
- The payload collects credentials and secrets from files, environment variables, GitHub Actions runner memory, cloud secret stores, Kubernetes, and HashiCorp Vault.
- The payload uses stolen npm credentials to modify and republish writable packages, and uses GitHub credentials to add execution hooks to repository branches.
- The payload exfiltrates encrypted data to a contract-selected HTTPS endpoint or, as a fallback, to a public GitHub repository.
- A response from the primary C2 can supply JavaScript that the payload evaluates inside the Bun process.
- Defensive Notes
- Check whether compromised package versions were installed in hosts, containers, and build environments.
- Block known malicious packages at installation time and monitor npm and PyPI package installations.
- Inspect the source, workflow, and artifact referenced by provenance; provenance alone is not a safety verdict.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| SHA256 | 14eb4ce01dd4307759887ff819359b70d7d9ff709ecde039a5abc1aac325b128 | SHA-256 hash of the maliciously injected .claude/settings.json artifact. |
| SHA256 | 166be2b7b58a440f7b17520ffb0368be5d89c76661704b4945417eb04b9ada65 | SHA-256 fingerprint of the key used to verify fallback C2 domains. |
| SHA256 | 29ac906c8bd801dfe1cb39596197df49f80fff2270b3e7fbab52278c24e4f1a7 | SHA-256 hash of the Python artifact used to collect GitHub Actions runner memory. |
| SHA256 | 3f3f42d072bd36860ab7bd7fb5e10ac0d22c741c13c89505ccd6ec0ea572eea7 | SHA-256 hash of the injected malicious GitHub workflow. |
| SHA256 | 619c56acf572df75b6004a6fc013c80900316a76099b241d64312da3a44f10b4 | SHA-256 hash of the token-monitor installer artifact identified in the article. |
| SHA256 | 927387d0cfac1118df4b383decc2ea6ba49c9d2f98b47098bcbcba1efc026e1f | SHA-256 hash of the maliciously injected .vscode/tasks.json artifact. |
| SHA256 | 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc | SHA-256 hash of the malicious stage-two payload. |
| SHA256 | dc1e6a7ddb29390dd53cf1e5aac40ad9204ea7c6b83ef5656e7cb7a796808b67 | SHA-256 fingerprint of the RSA public key used for exfiltration. |
| SHA256 | fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb | SHA-256 hash of the embedded and propagated malicious loader. |
| URL | hxxps[:]//awqhnjewqjkl[.]icu/router | C2 URL used for exfiltration. |
| URL | hxxps[:]//js-mirror[.]com/router | C2 URL used for exfiltration. |
| URL | hxxps[:]//npm-cache[.]com/router | C2 URL used for exfiltration. |
| URL | hxxps[:]//pypi-get[.]com/router | C2 URL used for exfiltration. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe payload sends collected data encrypted to its primary C2 endpoint.T1059.006 · PythonThe payload pipes an embedded Python program into sudo python3 to read GitHub Actions runner memory.T1059.007 · JavaScriptThe loader and second stage run JavaScript, and C2 responses can be evaluated as JavaScript.T1105 · Ingress Tool TransferWhen Bun is absent, the loader downloads a Bun release asset to run the second stage.T1195.002 · Compromise Software Supply ChainThe actor compromised npm packages and used them to distribute the payload.T1552.001 · Credentials In FilesThe payload searches selected files, histories, and configuration files for credentials and secrets.T1552.005 · Cloud Instance Metadata APIAWS credential resolution can query EC2 Instance Metadata Service Version 2.T1567.001 · Exfiltration to Code RepositoryThe fallback exfiltration path writes collected data to a public GitHub repository.
People
Malware
Products
AWSAWS Security Token Service (STS)BunThe loader accepts an installed bun or downloads Bun v1.3.13ClaudeFive GitHub-signed github-actions[bot] commits add identical Claude and Visual Studio Code execution hooks and payload blobs to v5, v4, the release lineage, main, and an existing Claude-named branch.Datadog Code SecurityDatadog Code Security can identify hosts, containers, and build environments where the compromised version was installed.GitHubOn August 4, 2026, we identified a malicious commit (174f6a5) in the GitHub repository of the popular keyv npm package.HashiCorp VaultHashiCorp VaultKubernetesKubernetesnpmOn August 4, 2026, a threat actor compromised hundreds of npm packages and used them to propagate a backdoor.SCFWDatadog also maintains the open source supply-chain security firewall (SCFW), which can proactively block known malicious packages at installation time.Visual Studio CodeFive GitHub-signed github-actions[bot] commits add identical Claude and Visual Studio Code execution hooks and payload blobs to v5, v4, the release lineage, main, and an existing Claude-named branch.