# ChainDrop npm Supply Chain Attack Steals Developer Credentials > Massive ChainDrop npm supply chain attack compromises over 1,300 packages, stealing developer and cloud credentials through malicious preinstall scripts. - Published: 2026-08-04T17:30:58.000Z - Severity: high - Category: Supply Chain - Tags: NPM, Supply Chain Attack, Infostealer, JavaScript, ChainDrop - Author: Runtime Rebel Intel - Primary source: https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/ - Canonical: https://runtimerebel.com/blog/chaindrop-npm-supply-chain-attack-steals-developer-credentials ## Key points - Massive npm supply-chain attack, ChainDrop, is actively stealing developer and cloud credentials from compromised systems. - Over 1,300 npm packages, including popular ones like Keyv and Cacheable, are currently compromised by this self-propagating worm. - Immediately rebuild affected systems, rotate all accessible credentials, and review logs for unauthorized activity. ## ChainDrop: A Widespread npm [Supply Chain Attack](/glossary#supply-chain-attack) A new and highly impactful supply chain attack, dubbed 'ChainDrop,' is actively compromising the Node Package Manager (npm) registry. This self-propagating [malware](/glossary#malware) has infected over 1,300 packages across 1,381 versions, affecting packages with a combined total of two billion monthly downloads. The attack targets developer and cloud credentials, posing a significant threat to software development pipelines and associated cloud infrastructure. Esteemed security firms like Aikido, Wiz, StepSecurity, Socket, and Ox Security have detected and are tracking the attack, providing vital intelligence on its mechanisms and indicators of compromise (IoCs), according to [BleepingComputer](https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/). ### Technical Analysis of the ChainDrop Compromise The ChainDrop attack originated from the compromise of a Keyv maintainer's GitHub account. This initial breach enabled the [threat actor](/glossary#threat-actor) to push malicious code directly to the main branches of various projects, subsequently generating new, poisoned package releases on npm. A critical element of this attack is that the malicious packages were built and published through legitimate GitHub Actions workflows, ensuring they carried valid provenance information. This made detection challenging, as the malicious versions appeared to be official releases. Upon installation via `npm install`, the `package.json` configuration file's `"preinstall": "node setup.mjs"` entry automatically executes the `setup.mjs` [payload](/glossary#payload) dropper. This dropper is responsible for downloading the Bun JavaScript runtime from its official GitHub release. The Bun runtime is then used to execute `Math_Symbol.js` (or `math_init.js` in some observed instances), which is the primary [infostealer](/glossary#infostealer) payload. After execution, `setup.mjs` attempts to delete the temporary runtime directory to cover its tracks. The `Math_Symbol.js` infostealer is heavily obfuscated and possesses self-spreading capabilities, enabling it to infect other packages from different maintainers that have used a previously compromised package. It specifically targets developer and cloud credentials present in the compromised environment. The malware first validates any discovered tokens against `registry.npmjs[.]org/-/whoami` in real-time before exfiltrating them. Collected credentials are encrypted and sent to a public GitHub repository with the description "Shai-Hulud: Here We Go Again," and also to the domain `npm-cache[.]com`, which serves as a strong indicator of compromise. Major organizations such as Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan have been associated with packages impacted by this widespread campaign. ### Mitigating ChainDrop Supply Chain Attacks Given the pervasive nature and severity of the ChainDrop attack, immediate and decisive action is required to secure affected environments. The primary goal for defenders should be to identify and neutralize any compromise rapidly and prevent further spread or [data exfiltration](/glossary#data-exfiltration). #### How to Detect ChainDrop npm Compromise Security teams should actively monitor for indicators of compromise (IoCs) provided by various security researchers. Key IoCs include: * **Network Activity:** Traffic to the domain `npm-cache[.]com` is a confirmed exfiltration channel for the infostealer. * **Malicious Files:** Hashes for `setup.mjs`, `Math_Symbol.js`, and `math_init.js` payloads, along with related artifacts, are available from security vendors like Wiz, StepSecurity, Aikido, Socket, and Ox Security. * **Unexpected Package Versions:** Cross-reference installed package versions against lists of compromised versions published by the aforementioned security research firms. #### Remediation Steps and Long-Term Security for npm [CI/CD](/glossary#ci-cd) Runners If an affected package version has been installed, the developer workstation or CI/CD runner must be treated as fully compromised, even if the malicious package was subsequently removed. The following actions are critical: * **System Rebuild:** Rebuild compromised systems from trusted, safe backups or from scratch to ensure all malicious components are purged. * **Credential Rotation:** Immediately rotate all developer tokens, [API](/glossary#api) keys, and cloud credentials that were accessible from the impacted environment. This includes GitHub tokens, npm tokens, and cloud service provider credentials. * **Log Review:** Conduct a thorough review of logs for any unauthorized access, unusual activity, or unexpected commits to source code repositories. * **Enhanced Controls:** Implement and enforce dependency allowlisting, integrity checks (e.g., Subresource Integrity, package integrity hashes), and provenance controls to verify the authenticity and integrity of all packages used in development and deployment pipelines. * **CI/CD [Hardening](/glossary#hardening):** For `securing npm CI/CD runners from infostealers`, ensure build environments are ephemeral, have minimal necessary permissions, and are subject to continuous monitoring for suspicious activity, particularly script execution within preinstall or postinstall hooks. **Related:** [IronWorm Malware: 36 npm Packages Identified in Supply Chain Attack](/blog/ironworm-malware-36-npm-packages-identified-in-supply-chain-attack), [Shai-Hulud Infostealer Surfaces in Malicious npm Package Campaign](/blog/shai-hulud-infostealer-surfaces-in-malicious-npm-package-campaign) --- AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/chaindrop-npm-supply-chain-attack-steals-developer-credentials