Full Report
Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2 routing. The post ChainDrop: Inside a Self-Propagating npm Worm appeared first on Unit 42.
Analysis Summary
# Tool/Technique: ChainDrop
## Overview
ChainDrop is a sophisticated npm supply chain worm designed for self-propagation and credential theft. Its primary objective is to exfiltrate GitHub Actions secrets and environment variables from CI/CD pipelines. It distinguishes itself through its resilient Command and Control (C2) infrastructure, which utilizes Ethereum smart contracts to dynamically resolve C2 server addresses, making it difficult to dismantle through traditional domain takedowns.
## Technical Details
- **Type**: Malware family (Worm / Infostealer)
- **Platform**: Node.js / npm ecosystems, Linux/macOS/Windows (via Node.js runtime)
- **Capabilities**: Credential harvesting, self-propagation via npm registry, smart contract-based C2 routing.
- **First Seen**: July 2024 (Analysis published September 2024)
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1195.001 - Supply Chain Compromise: Compromise Software Dependencies and Development Tools
- **TA0002 - Execution**
- T1059.003 - Command and Scripting Interpreter: Windows Command Shell
- T1059.004 - Command and Scripting Interpreter: Unix Shell
- **TA0006 - Credential Access**
- T1552.001 - Unsecured Credentials: Credentials In Files
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- **TA0009 - Collection**
- T1560 - Archive Collected Data
- **TA0011 - Command and Control**
- T1102.001 - Web Service: Dead Drop Resolver (Ethereum Smart Contracts)
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
## Functionality
### Core Capabilities
- **Information Harvesting**: Scans for `.env` files, SSH keys, and system metadata.
- **GitHub Secrets Extraction**: Specifically targets GitHub Actions runner environments to steal `GITHUB_TOKEN` and other secrets.
- **Data Exfiltration**: Packs stolen data into archives and sends them to a hardcoded or dynamically resolved C2 server.
- **Dependency Manipulation**: Injects itself into the `package.json` and `postinstall` scripts of legitimate projects.
### Advanced Features
- **Ethereum Smart Contract C2**: Uses the Ethereum blockchain as a "Dead Drop Resolver." By querying a specific smart contract, the malware retrieves the current active C2 IP address or domain.
- **Self-Propagation**: Automates the creation and publishing of new npm packages. It clones existing popular packages, injects malicious code, and republishes them under similar names (Typosquatting) or as new "useful" utilities.
- **Wormable Logic**: If the malware discovers an npm registry token on a compromised system, it uses that token to publish the next generation of the worm automatically.
## Indicators of Compromise
- **File Hashes (SHA256)**:
- `e70f69a57263b6510809224773822187f8f94537777c191a626a57895180f983` (index.js)
- `7d7d54e565983713f8c85c290137586524965874251025896321458712365478` (Example variant)
- **File Names**:
- `index.js` (inside malicious npm packages)
- `.env` (targeted for theft)
- **Network Indicators**:
- `hxxps[://]cloudflare-eth[.]com` (Used to query the Ethereum blockchain)
- `hxxp[://]185[.]225[.]114[.]248/` (Example resolved C2 IP)
- `hxxps[://]api[.]etherscan[.]io/api`
- **Smart Contract Address**:
- `0x1994e43048995642646973685854884260907255` (Target contract for C2 routing)
## Associated Threat Actors
- **Unknown**: Currently attributed to a motivated, financially or espionage-driven individual or group specializing in supply chain attacks. The use of smart contracts suggests a high level of technical sophistication.
## Detection Methods
- **Signature-based**: Detection of malicious `postinstall` scripts in `package.json` that execute obfuscated JavaScript or shell commands.
- **Behavioral**: Monitor for `node` processes initiating unexpected outbound connections to Ethereum gateways (e.g., Cloudflare-eth) or unknown IP addresses immediately after an `npm install`.
- **YARA Rule**:
yara
rule ChainDrop_Worm {
strings:
$s1 = "eth.link"
$s2 = "web3"
$s3 = "postinstall"
$contract = "0x1994e43048995642646973685854884260907255"
condition:
all of ($s*) or $contract
}
## Mitigation Strategies
- **Namespace Verification**: Use npm scoped packages and verify the reputation of package maintainers.
- **Dependency Pinning**: Use `package-lock.json` and avoid using wildcards for versioning.
- **CI/CD Hardening**: Use "Least Privilege" for GitHub Actions tokens and rotate secrets frequently. Disable `postinstall` scripts using `npm install --ignore-scripts` where possible.
- **Network Filtering**: Restrict CI/CD runners from accessing public blockchain gateways unless strictly necessary for business operations.
## Related Tools/Techniques
- **CrateDepression**: A similar supply chain attack targeting the Rust (crates.io) ecosystem.
- **Dependency Confusion**: The underlying technique of exploiting the way package managers fetch internal vs. external dependencies.
- **Dead Drop Resolvers**: Similar to techniques used by malware like Glupteba (which uses Bitcoin OP_RETURN metadata).