Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack

Summary

A supply chain attack dubbed ChainDrop has compromised over 400 NPM packages, publishing more than 2,200 malicious versions. The malware steals various credentials, including NPM and GitHub tokens, and uses them to propagate further by publishing poisoned package versions and infecting repositories. It also targets CI/CD environments and cloud infrastructure secrets.

Full text

More than 2,200 malicious versions of 440 packages were published to the NPM registry as part of a fresh Mini Shai-Hulud supply chain attack. Dubbed ChainDrop, the campaign started with 11 malware carriers in the keyv and cacheable namespaces, after their maintainer’s GitHub account was compromised. Combined, the infected packages have over 500 million weekly downloads. They are widely used across the ecosystem and their poisoning led to 433 additional packages being infected. Similar to previous Mini Shai-Hulud attacks, the infected packages executed malicious code during installation, dropping an information stealer with self-propagation functionality. On the infected machines, the malware targets all the secrets it can find, encrypts them, and then exfiltrates the data either to a dynamic HTTPS endpoint or to attacker-created public GitHub repositories that have the ‘Shai-Hulud: Here We Go Again’ description. “Once executed, the malware searches developer workstations and continuous integration and continuous delivery (CI/CD) environments for NPM, GitHub, cloud, and infrastructure credentials. It uses recovered identities to authenticate to NPM, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault, enabling it to enumerate packages, repositories, workflow secrets, cloud parameters, and secret-store values,” Microsoft explains.Advertisement. Scroll to continue reading. Additionally, the malware uses the stolen NPM credentials to publish poisoned versions of every package it can reach on the infected machine, and leverages compromised GitHub credentials and GitHub Actions to infect more repositories for credential theft, JFrog says. “After obtaining an NPM publishing token, it enumerates packages available to the compromised identity, downloads their latest tarballs, inserts the malware and setup loader, adds a preinstall hook, increments the patch version, and republishes the modified packages. The malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path,” Microsoft notes. Because the malware republished many historical versions of the compromised packages, the total number of malicious package iterations observed on August 4 reached 2,212 in under four hours, StepSecurity says. All infected package versions contained a preinstall dropper designed to download the legitimate Bun JavaScript runtime alongside 710 KB of obfuscated second-stage code representing the actual malware. An evolved descendant of the Shai-Hulud 2.0 worm, the malware uses an Ethereum blockchain for command-and-control (C&C), a technique called EtherHiding. The worm also installs a host-level dead-man’s switch: after achieving persistence on macOS and Linux, it polls the GitHub API using the victim’s stolen GitHub token every 60 seconds, and deletes its state and exits if the token stops working. It also self-clears after 24 hours, Socket notes. NPM developers who installed any of the infected package versions should consider their machines compromised. They are advised to remove the malware, rebuild CI runners and build machines, revoke and rotate potentially compromised credentials, and audit their GitHub repositories for anomalous activity. “Isolate affected systems. Preserve package tarballs, npm logs, CI logs, GitHub audit logs, and runner images before cleanup. You will need them to bound the exposure window,” JFrog recommends. Related: New GitHub, PyPI Policies Boost Supply Chain Security Related: US Bans Foreign-Made Humanoid Robots, Targeting China Over National Security Related: Trump Orders Defense Contractors to Map Software, Suppliers Across Critical Supply Chains Related: Multiple Jscrambler Packages Impacted by Supply Chain Attack Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Gemini Agent-to-Agent Attack Method Exposed Secrets, Enabled Pull Request TamperingDecades-Old BMC Vulnerability Exposes Thousands of Data Centers to Attacks150,000 Impacted by Madera Community Hospital Data BreachRiver Bank Says Hackers Deleted Data Stolen in Ransomware AttackBrinks Home Discloses Data Breach as Hackers Leak FilesRecent SonicWall Vulnerabilities Exploited in Ransomware AttacksRussian State APT Linked to Recent Public Wi-Fi Gateway HackingRuby on Rails Patches Critical Vulnerability Latest News CISA Warns of Exploited Langflow, N-central, and Tomcat VulnerabilitiesWater Sector Cyberattacks Reportedly Hit at Least 12 StatesBlack Hat USA 2026 – Summary of Vendor Announcements (Part 2)Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware LayerOligo Raises $60 Million for Runtime SecurityCISO Conversations: Russ Kirby – Passion Is the Antidote to BurnoutWeaponized Email AI Assistants Could Help Attackers Hijack AccountsZenity Raises $125 Million in Series C Funding Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Rethinking Cyber Defense for AI-Speed Attacks August 18, 2026 Join this live webinar as we explore if detection-first security operations can keep pace with AI, or if it’s time to rethink prevention as the strongest default. Register Virtual Event: CodeSecCon 2026 August 19, 2026 CodeSecCon bridges the gap between dev and security. Discover best practices for secure coding, innovative risk-reduction tools, and safe AI integration to cultivate a true DevSecOps culture. Safely secure your apps! Register People on the MovePNC Financial Services Group has appointed Christian Winward as CISO.Brian Gumbel has joined Armadin as Chief Revenue Officer.EigenQ has appointed Mark Pecen as Vice Chairman and Alexander Truskovsky as CISO.More People On The MoveExpert Insights Rethinking AI Security: Why CASB and DLP Need an Interaction-Aware Layer Build your strategy around answering these questions to ensure employees use AI productively while keeping sensitive data, IP, and agent behavior within the boundaries set for safe AI use. (Etay Maor) Timeless Compliance: Why Better Questions Beat Bigger Frameworks The best compliance programs aren't the biggest ones. They're the ones built on a short list of questions that can actually be answered, and that still hold true when the models change. (Matt Honea) Is Patching Dead? Vulnerability Management in the Post-Mythos Era You cannot out-patch a machine that writes a working exploit from a vulnerability description in twenty hours. Stop trying to optimize a game you cannot win. (Danelle Au) When Identity Verification Fails: Lessons from a Real-World SIM Swap and Near Account Takeover Identity confidence changes throughout every interaction and should be reassessed continuously as new risk signals emerge. (Torsten George) Legacy Systems, Real-World Impacts: The Reality of OT Security Legacy systems, safety concerns, and critical infrastructure risks make OT vulnerability disclosure one of cybersecurity's most challenging balancing acts. (Tod Beardsley) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — Mini Shai-Hulud
• malware — ChainDrop
• url — https://github.com/Shai-Hulud/Shai-Hulud

Entities