cyber.hendryadrian.com
Threat Research · securityweek.com

ChainDrop Supply-Chain Attack Infects 440 NPM Packages

· Original article ↗

Summary

ChainDrop reportedly infected 440 NPM packages with 2,212 malicious versions. The malware steals developer credentials, propagates through NPM and GitHub, and uses Ethereum for command-and-control. Developers are advised to rebuild affected systems and rotate secrets.

Key points

  • The campaign reportedly began with 11 malware-carrier packages in the keyv and cacheable namespaces after a maintainer’s GitHub account was compromised.
  • More than 2,200 malicious versions of 440 packages were published; the packages have over 500 million combined weekly downloads.
  • Malicious installation hooks deliver an information stealer that searches developer machines and CI/CD environments for credentials and secrets.
  • The malware uses stolen NPM credentials to republish reachable packages and compromised GitHub credentials and Actions to spread through repositories.
  • Microsoft says the malware can add Claude and Visual Studio Code configuration files to repositories to establish persistence and enable further infection.
  • The malware reportedly uses Ethereum-based EtherHiding for command-and-control and has a dead-man’s switch that checks a stolen GitHub token every 60 seconds.
  • Developers who installed affected versions are advised to rebuild machines and CI runners, rotate credentials, preserve relevant logs, and audit GitHub repositories.

Article Details

Attack Vectors
  • A maintainer’s compromised GitHub account was used to publish malicious versions of packages in the keyv and cacheable namespaces, which led to additional packages being infected.
  • Infected package versions ran a preinstall dropper that downloaded the Bun JavaScript runtime and obfuscated second-stage malware.
  • The malware searched developer workstations and CI/CD environments for credentials and secrets, then used recovered credentials to publish poisoned NPM packages and infect GitHub repositories.
  • The malware exfiltrated encrypted secrets to a dynamic HTTPS endpoint or attacker-created public GitHub repositories, and used an Ethereum blockchain for command-and-control.
  • The malware injected Claude and Visual Studio Code configuration files into repositories to establish persistence and enable further developer-to-developer infection.
Defensive Notes
  • Treat machines that installed infected package versions as compromised; remove the malware and rebuild CI runners and build machines.
  • Revoke and rotate potentially compromised credentials, and audit GitHub repositories for anomalous activity.
  • Before cleanup, isolate affected systems and preserve package tarballs, NPM logs, CI logs, GitHub audit logs, and runner images to help determine the exposure window.

MITRE ATT&CK

T1027 · Obfuscated Files or InformationThe downloaded second-stage malware was described as obfuscated.T1059.007 · JavaScriptInfected packages used a preinstall hook to run JavaScript that dropped the malware.T1078.004 · Cloud AccountsThe malware used stolen NPM and GitHub credentials to authenticate to services and publish or modify packages and repositories.T1105 · Ingress Tool TransferThe preinstall dropper downloaded the Bun runtime and obfuscated second-stage code.T1195.001 · Compromise Software Dependencies and Development ToolsThe attack used a compromised maintainer account to publish malicious versions of NPM packages, which then infected additional packages.T1526 · Cloud Service DiscoveryUsing recovered identities, the malware enumerated repositories, workflow secrets, cloud parameters, and secret-store values.T1567.002 · Exfiltration to Cloud StorageThe malware exfiltrated secrets to attacker-created public GitHub repositories.

Malware

ChainDropMore than 2,200 malicious versions of 440 packages were published to the NPM registry as part of a fresh Mini Shai-Hulud supply chain attack.Shai-Hulud 2An evolved descendant of the Shai-Hulud 2.0 worm, the malware uses an Ethereum blockchain for command-and-control (C&C), a technique called EtherHiding.

Vendors

Amazoncloud, and infrastructure credentials. It uses recovered identities to authenticate to NPM, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault, enabling it to enumerate packages, repositories,GitHubDubbed ChainDrop, the campaign started with 11 malware carriers in the keyv and cacheable namespaces, after their maintainer’s GitHub account was compromised.HashiCorpIt uses recovered identities to authenticate to NPM, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault, enabling it to enumerate packages, repositories, workflow secrets, cloud parameters, and

Products

BunAll infected package versions contained a preinstall dropper designed to download the legitimate Bun JavaScript runtime alongside 710 KB of obfuscated second-stage code representing the actual malware.ClaudeThe malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infectionGitHub Actionsevery package it can reach on the infected machine, and leverages compromised GitHub credentials and GitHub Actions to infect more repositories for credential theft, JFrog says.HashiCorp Vaultuses recovered identities to authenticate to NPM, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault, enabling it to enumerate packages, repositories, workflow secrets, cloud parameters, andKubernetescredentials. It uses recovered identities to authenticate to NPM, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault, enabling it to enumerate packages, repositories, workflow secrets, cloudnpmMore than 2,200 malicious versions of 440 packages were published to the NPM registry as part of a fresh Mini Shai-Hulud supply chain attack.VSCodeThe malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection

Related Articles