ChainDrop worm infects more than 1,300 npm packages with 2 billion downloads a month

The npm registry has been hit by yet another large-scale supply-chain attack. A self-propagating piece of malware called ChainDrop has, according to researchers, compromised more than 1,300 package versions with a combined audience of roughly 2 billion downloads a month.

How it started

The starting point was the hijacking of the GitHub account of a maintainer of the Keyv library. From there the infection quickly spread to related packages — Cacheable, flat-cache, file-entry-cache and other caching utilities by the same author — and then reached packages associated with Deliveroo, Ornikar, OneReach, Picsart, Qlik and ServiceTitan.

By the estimate of the company Aikido, the worm has affected at least 868 packages across 1,381 versions. The attacker was pushing malicious files straight into projects' main branches and cutting new releases. Because the build and publish steps ran through legitimate GitHub Actions workflows, the compromised releases carried correct provenance information — which made them especially insidious.

What's inside

The infected packages contain two files: a dropper, setup.mjs, and a data-stealing script (either Math_Symbol.js or math_init.js), and the package.json declares a "preinstall": "node setup.mjs" hook. Simply running npm install for an affected version was enough for the dropper to fire automatically, even before the installation finished.

The dropper downloads the Bun runtime executable from an official GitHub release, uses it to run the malicious script, and then deletes the temporary directory. The harvested credentials are encrypted and sent to a public GitHub repository with the telling description “Shai-Hulud: Here We Go Again” — a nod to an already-familiar family of worms.

The malware targets a wide range of secrets: GitHub tokens (ghp_, gho_, ghs_) and npm tokens, GitHub Actions secrets, AWS keys, values from SSM Parameter Store and Secrets Manager, Kubernetes secrets, HashiCorp Vault tokens, database credentials, as well as Stripe, Slack, Twilio, Azure and GCP keys. Each npm token is first validated in real time via registry.npmjs.org. The worm self-propagates by infecting the packages of other maintainers who had used a previously compromised dependency.

What to do

According to Wiz, the domain npm-cache[.]com is also used to exfiltrate data — it should be treated as a clear indicator of compromise. If an affected version was installed, the developer's workstation or the CI/CD runner should be considered compromised even after the package is removed: it is recommended to rebuild systems from clean backups or from scratch, rotate all available tokens, and check logs and repositories for unauthorized changes.

The attack is still unfolding, and the number of infected packages will keep growing. Lists of compromised packages and indicators of compromise are being published by Wiz, StepSecurity, Aikido, Socket and Ox Security.

Source: Bleeping Computer