Supply-Chain Malware Uses Blockchain Transactions for Resilient Command and Control
Summary
Unit 42 describes ChainDrop and PolinRider supply-chain campaigns that steal developer and cloud credentials, persist in build workflows, and use smart contracts or blockchain transactions to update command-and-control infrastructure.
Key points
- ChainDrop infected more than 400 npm packages and uses a preinstall hook to run a credential harvester.
- ChainDrop searches running build processes for ephemeral cloud IAM keys, CI/CD tokens, and short-lived OIDC keys.
- PolinRider targets npm, Go modules, and Packagist, hiding loaders in repository configuration, web resources, and IDE workspace automation.
- The campaigns use blockchain-based C2 methods including smart-contract lookups, transaction calldata across multiple chains, and zero-value transaction address decoding.
- The article links DPRK-affiliated activity across the Axios, Mastra AI, and Rust arrayref supply-chain compromises.
- Unit 42 recommends monitoring unexpected blockchain traffic, inspecting process-level endpoint and network activity, and enforcing CI/CD and version-control integrity policies.
Article Details
- Attack Vectors
- Poisoned open-source packages across npm, Go modules, Packagist, and crates.io execute malicious code through package lifecycle hooks, Rust compilation hooks, repository configuration files, and developer IDE workspace automation.
- ChainDrop searches disk and running build-process memory for cloud IAM credentials, CI/CD worker tokens, and short-lived OIDC federation keys, then uses blockchain smart-contract transactions to resolve C2 infrastructure.
- PolinRider loaders exfiltrate developer credentials, cloud session tokens, and environment secrets and resolve C2 through multi-chain transaction queries or zero-data address techniques.
- The article describes an Axios compromise in which a maintainer account was compromised and a backdoored dependency was injected into the package manifest; other reported operations poisoned Mastra AI npm packages and Rust's arrayref crate.
- NullReceiver resolves an IPv4 address from the recipient address of an actor-controlled wallet's latest zero-value transaction.
- Defensive Notes
- Baseline expected Web3 and blockchain activity; investigate unexpected outbound blockchain traffic, particularly from developer tools and build processes.
- Use endpoint and network controls for process-level inspection of developer workstations and CI/CD runners, and alert on unexpected blockchain gateway queries.
- Automate policy controls across CI/CD runners and version control systems to detect unauthorized repository configuration changes, hidden package-manifest script injections, and unverified lifecycle hooks before execution.
- Apply behavioral analytics and correlate network telemetry with normal developer traffic; static IOC blocklists and perimeter defenses alone may be insufficient.
Threat Actors
Alluring PiscesIdentified as a North Korea-affiliated state-sponsored actor associated with recent attributed supply-chain campaigns targeting Axios, Mastra AI, and Rust's arrayref; the article states it is also known as Sapphire Sleet or Midnight Neptune.MIDNIGHT NEPTUNEThe article identifies Midnight Neptune as another name for Alluring Pisces and associates the actor with recent attributed supply-chain campaigns.Sapphire SleetThe article identifies Sapphire Sleet as another name for Alluring Pisces and associates the actor with recent attributed supply-chain campaigns.
Malware
ChainDropRecent supply chain campaigns, most notably the ChainDrop npm worm and the PolinRider campaign, demonstrate how open-source packages are engineered specifically to extract ephemeral cloud access keys and establishShai-HuludTraced to the Shai-Hulud family, ChainDrop infected over 400 npm packages (including keyv and cacheable-request).
Products
AptosMechanisms range from multi-chain transaction queries across networks like TRON, Aptos and Binance Smart Chain (BSC) to zero-data address resolution techniques like NullReceiver.arrayreftheir recent attributed supply chain campaigns, including those targeting Axios, Mastra AI and Rust's arrayref.Axiosthese techniques across their recent attributed supply chain campaigns, including those targeting Axios, Mastra AI and Rust's arrayref.Binance Smart ChainMechanisms range from multi-chain transaction queries across networks like TRON, Aptos and Binance Smart Chain (BSC) to zero-data address resolution techniques like NullReceiver.crates.ioRust arrayref: Expanding into Rust, the actor poisoned the arrayref crate on crates.io, using Rust's native compilation hook to execute a second-stage payload upon project builds.Go modulesExpanding across developer ecosystems, the PolinRider campaign spans multiple package registries, including npm, Go modules and Packagist.Mastra AItechniques across their recent attributed supply chain campaigns, including those targeting Axios, Mastra AI and Rust's arrayref.npmRecent supply chain campaigns, most notably the ChainDrop npm worm and the PolinRider campaign, demonstrate how open-source packages are engineered specifically to extract ephemeral cloud access keys and establishPackagistExpanding across developer ecosystems, the PolinRider campaign spans multiple package registries, including npm, Go modules and Packagist.TRONMechanisms range from multi-chain transaction queries across networks like TRON, Aptos and Binance Smart Chain (BSC) to zero-data address resolution techniques like NullReceiver.