A self-propagating npm worm, dubbed "ChainDrop," has infected over 400 packages, including widely used ones like `keyv` and `cacheable-request`, which collectively see hundreds of millions of downloads weekly. The worm is designed to steal various sensitive developer data and credentials, potentially exposing developer workstations, continuous integration (CI) pipelines, cloud environments, and downstream software users across numerous organizations.
Once installed, ChainDrop targets cloud credentials, npm and GitHub tokens, SSH keys, and other sensitive developer information. It can also extract temporary credentials from GitHub Actions runner memory. The stolen npm publishing tokens are then used to infect and republish additional packages, maintaining their original functionality while embedding the worm.
Researchers observed 453 public GitHub repositories across five accounts matching the worm’s exfiltration patterns, and detected ChainDrop execution in 10 distinct environments. These repositories have since been removed. The malware achieves persistence through developer and AI coding tools and uses blockchain-based command-and-control (C2) resolution. On August 4, 2026, the attackers reconfigured the worm's entire C2 infrastructure through a single Ethereum transaction, bypassing the need for malware updates.
The infection mechanism is subtle: an infected npm package's `package.json` file is modified with a `preinstall` command. This command points to `setup.mjs`, a dropper that checks for the presence of Bun, a lightweight JavaScript runtime. If Bun 1.3.13 is not found, it is downloaded from the legitimate Oven GitHub repository. Bun is then used to execute a 727 KB obfuscated JavaScript payload, `math_init.js`, which is compressed into two source lines.
The payload spawns a detached background process and sets `_NODE_RUNTIME_INIT=1` to prevent recursive relaunch, allowing the package installation to complete without errors or warnings. In CI environments, the worm runs inline, making its debug output visible in workflow logs, which can serve as an indicator for defenders. Before engaging in data collection, the worm performs a locale check; if a Russian-language host is detected, it exits cleanly, printing "Exiting as russian language detected!"
The worm harvests a wide array of credentials and system information. This includes temporary identity and access management (IAM) role credentials from cloud infrastructure platforms by querying metadata and token endpoints of compute instances and container services. It also targets Docker and Helm configurations, Git credentials, mount listings, Poetry and PyPI credentials, RubyGems tokens, SSH keys, Terraform state, and Vault tokens.
Beyond developer tooling, ChainDrop seeks credentials from AI-assisted coding tools, cloud-based development platforms, and open-source coding assistant configurations. It also collects data from `.env` files, `.netrc` files, application configurations, Bitcoin and Electrum wallet files, Jenkins encrypted credential material, Kubernetes service-account tokens and kubeconfigs, and shell histories. Crucially, the npm and GitHub tokens it finds are essential for its continued propagation.
An embedded Python helper within the payload is responsible for scraping GitHub Actions runner memory. This helper, hidden in an encrypted blob, locates the `Runner.Worker` process, opens `/proc/pid/maps` and `/proc/pid/mem`, and searches for OpenID Connect (OIDC) tokens and runner secrets.
To mitigate such threats, it is recommended to identify and remove affected npm package versions, investigate developer workstations and CI runners for signs of compromise, and review unexpected npm publishing and GitHub repository activity. Additionally, potentially exposed npm, GitHub, cloud, SSH, and automation credentials should be revoked and rotated, identified persistence mechanisms removed, and both domain-based and GitHub-based exfiltration channels blocked.
