Full Report
Self-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly downloads on the Node Package Manager (npm) registry. [...]
Analysis Summary
# Incident Report: ChainDrop npm Supply-Chain Attack
## Executive Summary
The 'ChainDrop' incident is a massive supply-chain attack involving a self-propagating Shai-Hulud-based worm that compromised over 1,300 npm package versions. By hijacking a prominent maintainer's GitHub account, the attackers injected malicious payloads into high-traffic caching utilities, leading to the theft of sensitive cloud and developer credentials across thousands of environments. The attack is notable for its use of legitimate CI/CD workflows to maintain valid provenance and its ability to self-spread to other packages.
## Incident Details
- **Discovery Date:** August 4, 2026
- **Incident Date:** July – August 2024 (Ongoing at time of report)
- **Affected Organization:** Multiple (including Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan)
- **Sector:** Software Development / Technology
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** Early August 2026 (approximate)
- **Vector:** Credential Compromise
- **Details:** The threat actor gained unauthorized access to the GitHub account of a key maintainer responsible for popular packages like `Keyv` and `Cacheable`.
### Lateral Movement
- The worm used stolen GitHub Personal Access Tokens (PATs) and npm tokens found on infected developer machines and CI/CD runners to compromise additional repositories and packages managed by other users.
### Data Exfiltration/Impact
- **Credential Theft:** The malware harvested AWS, Azure, GCP, GitHub, npm, Slack, and Kubernetes secrets.
- **Supply Chain Poisoning:** Over 1,300 package versions were infected, affecting packages with a combined 2 billion monthly downloads.
### Detection & Response
- **Detection:** Discovered by multiple security firms (Aikido, Wiz, StepSecurity, Socket, Ox Security) through monitoring of npm registry anomalies.
- **Response Actions:** Security firms published lists of compromised versions; npm and GitHub began removing malicious artifacts and rotating internal infrastructure where possible.
## Attack Methodology
- **Initial Access:** Hijacked GitHub account of a major package maintainer.
- **Persistence:** Pushing malicious code directly to main branches; use of `preinstall` scripts in `package.json` to ensure execution upon every install.
- **Privilege Escalation:** Not explicitly detailed, but involved leveraging developer environment permissions to access sensitive environment variables.
- **Defense Evasion:** Use of legitimate GitHub Actions workflows to sign packages (maintaining valid provenance); obfuscated JavaScript; temporary use of Bun runtime followed by immediate deletion.
- **Credential Access:** Automated scanning of `.env` files, CI/CD secrets, and local config files for `ghp_`, `npm_`, and cloud provider tokens.
- **Discovery:** Real-time validation of stolen tokens against `registry.npmjs[.]org/-/whoami`.
- **Lateral Movement:** Self-propagating worm logic designed to infect other repositories accessible via stolen tokens.
- **Collection:** Gathering complete process environments, AWS SSM Parameter Store values, and HashiCorp Vault tokens.
- **Exfiltration:** Data encrypted and sent to a public GitHub repository or the `npm-cache[.]com` domain.
- **Impact:** Massive exposure of production secrets and broad-scale supply chain contamination.
## Impact Assessment
- **Financial:** High (Potential for secondary breaches using stolen cloud/payment credentials).
- **Data Breach:** Extensive theft of API keys, private keys, and cloud infrastructure credentials.
- **Operational:** Significant disruption as organizations must rotate all credentials and rebuild CI/CD runners.
- **Reputational:** High impact on the npm ecosystem’s trust and the specific maintainers whose accounts were used.
## Indicators of Compromise
- **Network Indicators:**
- `npm-cache[.]com`
- `registry.npmjs[.]org/-/whoami` (unusual traffic patterns)
- **File Indicators:**
- `setup.mjs` (Dropper)
- `Math_Symbol.js` (Infostealer)
- `math_init.js` (Infostealer variant)
- **Behavioral Indicators:**
- Unexpected `preinstall` entries in `package.json`.
- Automated downloads of the Bun runtime in CI/CD environments.
- Commits to main branches containing "Shai-Hulud" references.
## Response Actions
- **Containment:** Organizations should block traffic to the `npm-cache[.]com` domain.
- **Eradication:** Identify and remove all affected npm package versions from `package-lock.json` and local caches.
- **Recovery:** Rebuild compromised developer workstations and CI/CD runners from scratch; rotate every secret that was present in the environment during the infection window.
## Lessons Learned
- **MFA is Critical:** The compromise of a single GitHub account allowed for massive downstream impact.
- **Provenance is not a Silver Bullet:** Attackers successfully used legitimate build pipelines (GitHub Actions) to create "valid" malicious packages.
- **Runtime Monitoring:** Monitoring the execution of `preinstall` scripts could have flagged the unauthorized download of the Bun executable.
## Recommendations
- **Enforce MFA:** Require Multi-Factor Authentication for all package maintainers and GitHub contributors.
- **Dependency Pinning:** Use specific versions and subresource integrity (SRI) checks.
- **Secret Management:** Use short-lived tokens and OIDC for CI/CD instead of long-lived secrets.
- **Network Egress Filtering:** Restrict CI/CD runners from accessing arbitrary external domains during build/install phases.