A new variant of the Shai-Hulud npm worm, dubbed "ChainDrop" by Microsoft and other security researchers, has infected 444 packages within the npm supply chain. This latest iteration, identified on August 4, employs novel propagation techniques that allow it to spread with minimal trace in source repositories, impacting packages downloaded approximately 2 billion times monthly. The attack specifically targeted widely used infrastructure dependencies, including `keyv`, `flat-cache`, and `cache-manager`.
Unlike typical open-source repository breaches, ChainDrop can infect systems even without direct installation of a malicious package via `npm install`. The worm achieves self-replication by manipulating tarballs, an archive format used for package downloads. When executed, ChainDrop scans the user's workspace for npm tokens with full write privileges, as well as other credentials like cloud keys and secrets, searching shell configurations, environment variables, and live memory.
Upon discovering an npm token, ChainDrop downloads the tarballs of all packages accessible to that token. It then rebuilds these tarballs to embed its own malicious payload, effectively bypassing source repositories. This method means that reviewing the corresponding source code repository will not reveal any evidence of tampering. The purloined data is encrypted and transmitted to attacker-controlled endpoints.
The attack also has a second vector: it searches for GitHub credentials. If found, it queries the GitHub API to list all accessible repositories and branches, then directly commits malicious configuration code into those branches. When other developers subsequently open these repositories using development environments like VS Code or Claude Code, a background task is triggered, initiating the credential harvesting cycle anew. ChainDrop places startup hooks into repository configuration files, such as `.claude/settings.json` and `.vscode/tasks.json`, which can bring a repository under its control simply by opening an infected Git branch in these editors.
This attack is particularly concerning due to npm's deep integration into automated CI/CD pipelines, which often automatically pull dependency updates during builds, providing a pathway for the worm to infiltrate fresh builds.
Developers who suspect infection should check for any `.claude/settings.json` and `.vscode/tasks.json` files they did not add themselves, across all branches, not just the main branch. All compromised packages have been removed from npm. Open-source security firm SafeDep has provided a list of all affected packages and their version numbers for verification.
Beyond immediate cleanup, security experts advise developers and security teams to re-evaluate their systems' potential vulnerabilities in light of ChainDrop. This includes scrutinizing trusted publishing tools like GitHub Actions and beginning to treat repository-supplied configuration as executable content. The campaign exploited an execution path that dependency scanning tools were not configured to monitor, a gap found within tools widely adopted by engineering organizations. This marks the first large-scale campaign to leverage this specific vulnerability, and it is anticipated not to be the last.
