Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack
A supply chain attack dubbed ChainDrop published over 2,200 malicious versions of 440 NPM packages, leveraging compromised maintainer accounts in the keyv and cacheable namespaces The malware, an evolved descendant of Shai-Hulud 2.0, uses a technique called EtherHiding to employ the Ethereum blockchain for command-and-control communications The worm self-propagates by using stolen NPM credentials to republish poisoned package versions and GitHub credentials to inject malicious configuration file
Analysis
TL;DR
- A supply chain attack dubbed ChainDrop published over 2,200 malicious versions of 440 NPM packages, leveraging compromised maintainer accounts in the keyv and cacheable namespaces
- The malware, an evolved descendant of Shai-Hulud 2.0, uses a technique called EtherHiding to employ the Ethereum blockchain for command-and-control communications
- The worm self-propagates by using stolen NPM credentials to republish poisoned package versions and GitHub credentials to inject malicious configuration files into repositories via GitHub Actions
- Infected packages carry a preinstall dropper that downloads the Bun JavaScript runtime and 710 KB of obfuscated second-stage malware, targeting secrets from developer workstations and CI/CD environments
- The malware includes a dead-man's switch that polls the GitHub API every 60 seconds and self-terminates if the stolen token becomes invalid or after 24 hours
Why It Matters
This attack demonstrates the escalating sophistication of supply chain threats targeting the JavaScript ecosystem, with over 500 million weekly downloads at risk across widely used packages. The use of blockchain-based C2 (EtherHiding) and automated self-propagation through compromised credentials represents a significant evolution in malware tradecraft that threatens not only individual developers but the broader software supply chain.
Technical Details
- The attack originated from 11 compromised packages in the keyv and cacheable namespaces after the maintainer's GitHub account was breached, cascading to infect 433 additional packages
- The malware dropper executes during npm install, downloading the legitimate Bun JavaScript runtime alongside obfuscated second-stage code (710 KB) that functions as an information stealer
- Stolen credentials are used to authenticate across NPM, GitHub, AWS, Kubernetes, and HashiCorp Vault, enabling enumeration of packages, repositories, workflow secrets, and cloud parameters
- The worm republishes poisoned versions by downloading tarballs, inserting malware and a preinstall hook, incrementing patch versions, and republishing — achieving 2,212 malicious iterations in under four hours
- C2 communication uses EtherHiding (Ethereum blockchain), and the dead-man's switch deletes state and exits if the GitHub token stops working or after 24 hours
Industry Insight
- Organizations should enforce strict package integrity verification and consider software bill of materials (SBOM) practices to detect tampered dependencies before deployment
- The rapid self-propagation capability (2,200+ versions in under four hours) underscores the need for real-time supply chain monitoring and automated anomaly detection in package registries
- Developers should rotate credentials immediately, rebuild CI/CD runners from clean images, and audit GitHub repositories for injected configuration files in Claude and VS Code settings
Disclaimer: The above content is generated by AI and is for reference only.