ChainDrop Worm Compromises Over 1,300 npm Packages, Targets Developer Credentials
Summary
ChainDrop spread through compromised npm packages after a maintainer’s GitHub account was breached. The worm uses GitHub Actions releases and Bun-based payloads to steal developer and cloud credentials and propagate to more packages.
Key points
- Aikido reported at least 868 compromised packages across 1,381 versions; the article says the campaign affected more than 1,300 packages with about 2 billion monthly downloads.
- The attack began with the compromise of the GitHub account of Keyv’s maintainer and spread to related packages and packages associated with major organizations.
- Malicious releases used legitimate GitHub Actions workflows and carried valid provenance information.
- Affected packages used a preinstall hook to run setup.mjs, which downloaded Bun and executed Math_Symbol.js; BleepingComputer also saw packages containing math_init.js.
- The malware searched developer systems and CI/CD runners for tokens, cloud credentials, secrets, keys, and other sensitive data, then encrypted collected credentials before sending them to a public GitHub repository.
- Wiz identified npm-cache[.]com as an exfiltration indicator; tokens were reportedly validated against registry.npmjs[.]org/-/whoami.
- Administrators who installed an affected version are advised to treat the system as compromised, rebuild it, rotate accessible tokens, and review logs and repositories.
Article Details
- Attack Vectors
- The attack began with the reported compromise of the Keyv maintainer’s GitHub account. Malicious files were pushed to affected projects’ main branches and released through their legitimate GitHub Actions workflows.
- Affected npm packages included a preinstall entry that automatically ran setup.mjs during installation. The dropper downloaded Bun and used it to execute the credential-stealing Math_Symbol.js or math_init.js payload.
- The malware could spread to packages from other maintainers that used a previously compromised package.
- The payload collected developer, cloud, and CI/CD credentials and other sensitive data, encrypted the collected data, and sent it to a public GitHub repository. Wiz also identified npm-cache[.]com as being used for data exfiltration.
- Defensive Notes
- Treat a developer workstation or CI/CD runner as compromised if an affected package version was installed, even if the package was later removed.
- Rebuild affected systems from safe backups or from scratch, rotate tokens accessible to the impacted environment, review logs for unauthorized access, and check repositories for unexpected commits or changes.
- Continue using dependency allowlisting, integrity checks, and provenance controls; the article says the attack was still unfolding and the affected package count and versions could grow.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | npm-cache[.]com | Wiz identified this domain as being used to exfiltrate data and recommended treating it as a strong indicator of compromise. |
MITRE ATT&CK
T1005 · Data from Local SystemThe payload searched infected development systems and CI/CD runners for credentials and other sensitive local data.T1027 · Obfuscated Files or InformationThe article describes the malicious JavaScript payload as heavily obfuscated.T1059.007 · JavaScriptThe npm preinstall script ran setup.mjs, which launched the malicious JavaScript payload using Bun.T1105 · Ingress Tool Transfersetup.mjs downloaded the Bun JavaScript runtime from an official GitHub release before running the payload.T1195.002 · Compromise Software Supply ChainThe attacker compromised npm packages and published malicious releases through affected projects’ legitimate release workflows.T1528 · Steal Application Access TokenThe malware collected GitHub PATs, workflow tokens, npm tokens, and other credentials that could provide access to repositories and packages.T1552.001 · Credentials In FilesThe malware collected credentials from local configuration and credential files.T1567.001 · Exfiltration to Code RepositoryThe article says the malware sent encrypted stolen data to a public GitHub repository.
Malware
ChainDropChainDrop is a self-propagating malware campaign that has compromised more than 1,300 npm packages with about 2 billion monthly downloads, including widely used libraries like Keyv, Cacheable, flat-cache, andShai-HuludMultiple application security companies spotted the attack and discovered that it deployed a Shai-Hulud-based worm named ChainDrop.
Products
BunThe payload used setup.mjs to download Bun and run Math_Symbol.js or math_init.js for data theft.cacheable1,300 npm packages with about 2 billion monthly downloads, including widely used libraries like Keyv, Cacheable, flat-cache, and file-entry-cache.file-entry-cache2 billion monthly downloads, including widely used libraries like Keyv, Cacheable, flat-cache, and file-entry-cache.flat-cachepackages with about 2 billion monthly downloads, including widely used libraries like Keyv, Cacheable, flat-cache, and file-entry-cache.GitHub ActionsThe attack spread through a maintainer’s GitHub account compromise and used legitimate GitHub Actions releases to deliver infostealing payloads targeting developer, cloud, and CI/CD credentials.keyvmore than 1,300 npm packages with about 2 billion monthly downloads, including widely used libraries like Keyv, Cacheable, flat-cache, and file-entry-cache.npmChainDrop is a self-propagating malware campaign that has compromised more than 1,300 npm packages with about 2 billion monthly downloads, including widely used libraries like Keyv, Cacheable, flat-cache, and