A sophisticated new software supply chain attack, dubbed "ChainDrop," has been observed infecting over 400 npm packages, including widely used libraries such as `keyv` and `cacheable-request`. This attack leverages a three-step process to steal credentials and propagate itself, highlighting a growing trend of attackers targeting the tools and environments developers use rather than just finished software.
The ChainDrop worm initiates its attack by modifying package manifests to include a malicious `preinstall` script. This script downloads the legitimate Bun runtime, which is then used to silently launch a 727 KB obfuscated payload in the background when a developer runs `npm install`.
Once executed, a hidden Python script within the payload directly reads live process memory from GitHub Actions runners. This method allows the worm to steal temporary OpenID Connect (OIDC) tokens and secrets, in addition to conducting a broad sweep for local developer credentials. Unlike traditional methods that scrape disk files, this approach targets in-memory data, making it more evasive.
The stolen npm and GitHub tokens are subsequently used by the worm to self-propagate. It silently infects and republishes additional packages while ensuring their legitimate functionality remains intact, a tactic designed to prevent detection by developers. ChainDrop also establishes long-term persistence by embedding cross-linked hooks directly into developer tools like VS Code and Claude Code. Its command-and-control (C2) infrastructure is managed dynamically through Ethereum blockchain transactions.
The attack targets three distinct areas: cloud secret harvesting by scraping unencrypted credentials and platform access tokens from build server memory, local endpoint backdooring by modifying developer tool configurations (such as VS Code's `tasks.json`) to maintain attacker access, and automated propagation through the creation of rogue code repositories using stolen tokens.
This incident underscores the expanding attack surface in modern software development, where open-source and third-party packages are integral to every phase of the software development lifecycle (SDLC). With 80-90% of modern codebases comprising open-source components, the risk extends to developer laptops, CI/CD pipelines, and cloud infrastructure. The effectiveness of such attacks is attributed to the lack of basic guardrails in developer tools, which often run with high privileges, granting malware unrestricted access to files, keys, and command execution.
To counter these threats, experts recommend a shift from reactive code scanning to strict execution control across the entire build path. This includes hardening developer environments by disabling lifecycle install scripts (`--ignore-scripts`), enforcing package cooldown periods, restricting CI/CD egress traffic, utilizing ephemeral CI/CD servers, and pinning dependencies to exact commit SHAs. Beyond application code, a comprehensive approach requires generating a "pipeline bill of materials" (PBOM) to inventory all tools within a build system, and a "container SBOM" to track both application code and underlying operating system tools in cloud environments.
