ChainDrop npm Supply Chain Attack Steals Developer Credentials

ChainDrop: A Widespread npm Supply Chain Attack

A new and highly impactful supply chain attack, dubbed ‘ChainDrop,’ is actively compromising the Node Package Manager (npm) registry. This self-propagating malware has infected over 1,300 packages across 1,381 versions, affecting packages with a combined total of two billion monthly downloads. The attack targets developer and cloud credentials, posing a significant threat to software development pipelines and associated cloud infrastructure. Esteemed security firms like Aikido, Wiz, StepSecurity, Socket, and Ox Security have detected and are tracking the attack, providing vital intelligence on its mechanisms and indicators of compromise (IoCs), according to BleepingComputer.

Technical Analysis of the ChainDrop Compromise

The ChainDrop attack originated from the compromise of a Keyv maintainer’s GitHub account. This initial breach enabled the threat actor to push malicious code directly to the main branches of various projects, subsequently generating new, poisoned package releases on npm. A critical element of this attack is that the malicious packages were built and published through legitimate GitHub Actions workflows, ensuring they carried valid provenance information. This made detection challenging, as the malicious versions appeared to be official releases.

Upon installation via npm install, the package.json configuration file’s "preinstall": "node setup.mjs" entry automatically executes the setup.mjs payload dropper. This dropper is responsible for downloading the Bun JavaScript runtime from its official GitHub release. The Bun runtime is then used to execute Math_Symbol.js (or math_init.js in some observed instances), which is the primary infostealer payload. After execution, setup.mjs attempts to delete the temporary runtime directory to cover its tracks.

The Math_Symbol.js infostealer is heavily obfuscated and possesses self-spreading capabilities, enabling it to infect other packages from different maintainers that have used a previously compromised package. It specifically targets developer and cloud credentials present in the compromised environment. The malware first validates any discovered tokens against registry.npmjs[.]org/-/whoami in real-time before exfiltrating them. Collected credentials are encrypted and sent to a public GitHub repository with the description “Shai-Hulud: Here We Go Again,” and also to the domain npm-cache[.]com, which serves as a strong indicator of compromise. Major organizations such as Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan have been associated with packages impacted by this widespread campaign.

Mitigating ChainDrop Supply Chain Attacks

Given the pervasive nature and severity of the ChainDrop attack, immediate and decisive action is required to secure affected environments. The primary goal for defenders should be to identify and neutralize any compromise rapidly and prevent further spread or data exfiltration.

How to Detect ChainDrop npm Compromise

Security teams should actively monitor for indicators of compromise (IoCs) provided by various security researchers. Key IoCs include:

• Network Activity: Traffic to the domain npm-cache[.]com is a confirmed exfiltration channel for the infostealer.
• Malicious Files: Hashes for setup.mjs, Math_Symbol.js, and math_init.js payloads, along with related artifacts, are available from security vendors like Wiz, StepSecurity, Aikido, Socket, and Ox Security.
• Unexpected Package Versions: Cross-reference installed package versions against lists of compromised versions published by the aforementioned security research firms.

Remediation Steps and Long-Term Security for npm CI/CD Runners

If an affected package version has been installed, the developer workstation or CI/CD runner must be treated as fully compromised, even if the malicious package was subsequently removed. The following actions are critical:

• System Rebuild: Rebuild compromised systems from trusted, safe backups or from scratch to ensure all malicious components are purged.
• Credential Rotation: Immediately rotate all developer tokens, API keys, and cloud credentials that were accessible from the impacted environment. This includes GitHub tokens, npm tokens, and cloud service provider credentials.
• Log Review: Conduct a thorough review of logs for any unauthorized access, unusual activity, or unexpected commits to source code repositories.
• Enhanced Controls: Implement and enforce dependency allowlisting, integrity checks (e.g., Subresource Integrity, package integrity hashes), and provenance controls to verify the authenticity and integrity of all packages used in development and deployment pipelines.
• CI/CD Hardening: For securing npm CI/CD runners from infostealers, ensure build environments are ephemeral, have minimal necessary permissions, and are subject to continuous monitoring for suspicious activity, particularly script execution within preinstall or postinstall hooks.

Related: IronWorm Malware: 36 npm Packages Identified in Supply Chain Attack, Shai-Hulud Infostealer Surfaces in Malicious npm Package Campaign