A self-propagating malware, dubbed "ChainDrop," has compromised over 1,300 packages across the Node Package Manager (npm) registry, impacting packages with a combined 2 billion monthly downloads. The attack began after a threat actor gained control of the GitHub account belonging to the maintainer of several popular caching utilities, including Keyv, Cacheable, flat-cache, and file-entry-cache. The compromise quickly spread to packages associated with major organizations such as Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.
Security researchers have confirmed that at least 868 packages across 1,381 versions have been affected. The attacker pushed malicious files directly to the main branches of these projects and subsequently generated new package releases. Because the packages were built and published via their legitimate GitHub Actions workflows, the compromised npm releases carried valid provenance information, making them appear legitimate.
The poisoned packages contain two primary malicious files: `setup.mjs`, which acts as a payload dropper, and `Math_Symbol.js` (or `math_init.js` in some observed instances), a script designed for information theft. The `package.json` configuration file of affected packages includes a `"preinstall": "node setup.mjs"` entry, ensuring that `setup.mjs` executes automatically before the installation completes when `npm install` is run.
The `setup.mjs` dropper downloads the Bun JavaScript runtime from its official GitHub release to execute the `Math_Symbol.js` or `math_init.js` infostealer. After launching the infostealer script, `setup.mjs` deletes the temporary runtime directory. The infostealer itself is heavily obfuscated and possesses self-spreading capabilities, enabling it to infect packages from other maintainers who have used a previously compromised package.
The infostealer collects a wide array of sensitive information from compromised development environments and CI/CD runners. This includes developer and cloud credentials, which are then encrypted and exfiltrated to a public GitHub repository with the description "Shai-Hulud: Here We Go Again." Data collected includes the complete process environment, local configuration and credential files, GitHub Personal Access Tokens (PATs) and workflow tokens (ghp_, gho_, ghs_ tokens), npm tokens (npm_ tokens), and GitHub Actions secrets, including values marked as `isSecret:true` from self-hosted runners.
Additionally, the malware targets AWS credentials, SSM Parameter Store values (using `WithDecryption: true`), Secrets Manager secrets, Kubernetes secrets from accessible namespaces, HashiCorp Vault tokens and KV secrets, database credentials, private keys, and credentials for services like Stripe, Slack, Twilio, Azure, and GCP. The domain `npm-cache[.]com` has also been identified as being used for data exfiltration.
Security experts advise that if an affected package version was installed, the developer workstation or CI/CD runner should be considered compromised, even if the package was subsequently removed. Recommended remediation steps include rebuilding systems from safe backups or from scratch, rotating all tokens accessible from the impacted environment, and reviewing logs for unauthorized access and repositories for unexpected commits or changes.
As the attack is ongoing, the number of compromised packages and specific malicious versions is expected to increase. Organizations are urged to continue using dependency allowlisting, integrity checks, and provenance controls to mitigate risks. Several security firms have published lists of compromised npm packages and indicators of compromise, including hashes for malicious files and artifacts, and network data.
