ChainDrop npm Worm Steals Developer Credentials and Spreads Malicious Packages
Summary
Zscaler details ChainDrop, a Shai-Hulud variant that poisoned npm packages, stole credentials, and spread through developer tokens. It uses Ethereum-based C2 and IDE hooks, and may trigger destructive activity when stolen tokens are revoked.
Key points
- The worm entered npm through a compromised maintainer account and poisoned packages using the project's legitimate GitHub Actions release workflow.
- Aikido Security researchers found propagation to more than 400 packages through stolen npm publishing tokens.
- Its dropper runs during npm installation, downloads Bun, and launches an obfuscated payload designed to evade Node.js-focused monitoring.
- The payload targets npm, GitHub, cloud, Kubernetes, Vault, SSH, collaboration, and AI developer-tool credentials.
- It exfiltrates stolen data through public GitHub repositories or retrieves fallback C2 domains from an Ethereum smart contract.
- IDE and AI-tool hooks can relaunch the malware when projects are opened; some variants trigger destructive activity after a stolen GitHub token is revoked.
Article Details
- Attack Vectors
- The attacker compromised a maintainer's GitHub account and injected malicious files and a preinstall hook into package repositories. The legitimate GitHub Actions release workflow then published poisoned npm packages.
- The worm stole developer credentials, including npm publishing tokens, and used them to infect and republish packages writable by those tokens.
- The payload executed through Bun after npm installation, and additional hooks could trigger execution when projects were opened in VS Code or Claude Code sessions began.
- Stolen credentials were exfiltrated through public GitHub repositories created under victims' identities, with Ethereum smart-contract lookup of C2 domains used as a fallback.
- Some variants reportedly triggered a destructive payload, potentially including remote code execution or deletion of the user's home directory, after a stolen GitHub token returned a 4xx error.
- Defensive Notes
- Revoke compromised npm, GitHub, cloud, Kubernetes, Vault, SSH, and other exposed credentials; review package publishing and repository activity for unauthorized changes.
- Inspect affected packages for setup.mjs, Math_Symbol.js, and unexpected package.json preinstall hooks, and review developer environments and CI runners where poisoned packages were installed.
- Review GitHub for suspicious public repositories with descriptions "Shai-Hulud: Here We Go Again" or "niagA oG eW ereH :duluH-iahS".
- Do not rely solely on domain-based blocklists: the article says the malware retrieves active C2 domains from an Ethereum smart contract and can rotate domains.
- The article notes that valid provenance attestations and signed releases did not prevent poisoned packages when the attacker controlled the source repository and release workflow.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | awqhnjewqjkl[.]icu | C2 domain listed in the article's indicators. |
| DOMAIN | npm-cache[.]com | Confirmed fallback C2 domain identified in the article. |
| MD5 | 4140f7e17e6f97f83aa3472473e01add | MD5 indicator listed for the ChainDrop threat. |
| MD5 | 7bcf8d9f6834c44450eac145a967d2f2 | MD5 indicator listed for the ChainDrop threat. |
| MD5 | f92ee93a0af971a3966bfa8efa9c2625 | MD5 indicator listed for the ChainDrop threat. |
| URL | hxxps[:]//npm-cache[.]com/router | C2 URL identified in the article. |
MITRE ATT&CK
T1059.007 · JavaScriptThe package's preinstall hook launches setup.mjs, which runs the second-stage JavaScript payload via Bun.T1195.002 · Compromise Software Supply ChainThe attacker compromised a maintainer's source repository and caused its release workflow to publish poisoned npm packages.T1485 · Data DestructionSome variants reportedly delete the user's home directory after detecting that a stolen GitHub token was revoked.T1552.001 · Credentials In FilesThe payload harvests credentials from files including ~/.npmrc, ~/.aws/credentials, ~/.kube/config, and ~/.ssh/.T1567.001 · Exfiltration to Code RepositoryThe worm exfiltrates credentials by creating public GitHub repositories under victims' identities.
Threat Actors
Malware
ChainDropentered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP. ChainDrop anchored its C2 infrastructure in an Ethereum smart contract, allowingChainDropOn August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP. ChainDrop anchored its C2Shai-Huludentered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP. ChainDrop anchored its C2 infrastructure in an Ethereum smart contract, allowing the
Vendors
Products
AWSAWS credentials from ~/.aws/credentials, IMDS/ECS metadata endpoints, and environment variables.AzureGoogle Cloud and Azure credentials from service account files and environment-based authentication.BunDownloads the Bun JavaScript runtime v1.3.13 directly from its official GitHub release page.Claude CodeAI tooling credentials and configuration for Claude Code and GitHub Copilot.GitHubThe attacker compromised the GitHub account of the maintainer of the keyv ecosystem, injecting malicious code into the source repository. This caused the project's own GitHub Actions-based release pipeline to build andGitHub Actionskeyv ecosystem, injecting malicious code into the source repository. This caused the project's own GitHub Actions-based release pipeline to build and publish poisoned versions of packages including keyv, cacheable,GitHub CopilotAI tooling credentials and configuration for Claude Code and GitHub Copilot.Google CloudGoogle Cloud and Azure credentials from service account files and environment-based authentication.HashiCorp VaultHashiCorp Vault tokens including VAULT_TOKEN and related environment variables.KubernetesKubernetes credentials from ~/.kube/config and service account tokens.npmOn August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP. ChainDrop anchored its C2SlackSlack and Stripe tokens and other API keys from environment variables or configuration files.StripeSlack and Stripe tokens and other API keys from environment variables or configuration files.VS Code.vscode/tasks.json: Hooks VS Code to execute the payload when a project folder is opened.