Loading malware…
ChainDrop is a self-propagating npm supply-chain worm and credential-harvesting malware campaign associated with the Shai Hulud or Mini Shai Hulud lineage. It compromises legitimate npm packages by abusing stolen maintainer credentials and publishing trojanized releases through trusted build and release workflows, including GitHub Actions, allowing malicious versions to appear as legitimate signed or provenance-backed releases.
The malware executes during package installation through the npm preinstall lifecycle, so compromise can occur during dependency installation or restore operations without the package being imported by application code. Observed samples use an obfuscated loader that retrieves a Bun runtime and launches a second-stage JavaScript payload. That payload is designed to harvest secrets from developer workstations and CI/CD runners, including npm credentials, GitHub tokens, cloud credentials, Kubernetes and Vault secrets, SSH keys, database credentials, API keys, and other environment-exposed build secrets. Reported behavior also includes dumping GitHub Actions runner memory, parsing local configuration files, scanning disks and environment variables for credentials, validating stolen npm tokens, encrypting collected data, and exfiltrating it through attacker-controlled infrastructure including GitHub-hosted repositories and an Ethereum-based dead-drop mechanism.
ChainDrop’s worming behavior relies on reusing stolen npm or maintainer credentials to publish additional compromised package versions across unrelated maintainer scopes, enabling rapid propagation through the Node.js ecosystem. The campaign affected widely used packages and large numbers of downstream dependencies, creating risk not only to application code but also to source control, cloud infrastructure, and production environments reachable from infected developer or CI/CD systems. High-confidence reporting places initial observation on 2026-08-04 and links the activity to a broad software supply-chain compromise impacting hundreds to more than a thousand package versions.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Then the worm uses any freshly stolen npm credentials to publish backdoored updates to other packages the victim owns.
Attackers compromised the GitHub account of a maintainer behind several widely used Node.js utility packages, including keyv, cacheable, flat-cache, and file-entry-cache. They pushed malicious code directly to the main branch. That triggered the maintainer’s own GitHub Actions pipelines to build and publish infected versions straight to the npm registry, complete with valid digital signatures.
Attackers compromised the GitHub account of a maintainer behind several widely used Node.js utility packages... They pushed malicious code directly to the main branch. That triggered the maintainer’s own GitHub Actions pipelines to build and publish infected versions straight to the npm registry
To dodge detection, it downloads a temporary Bun runtime executable, which then runs a heavily obfuscated payload named Math_Symbol.js.
It dumps GitHub Actions runner memory to capture temporary publishing tokens.
It dumps GitHub Actions runner memory to capture temporary publishing tokens.
including npm authentication tokens... GitHub Actions secrets and tokens... It also looks for and uses npm tokens to propagate.
It also crawls local disks for SSH keys, .env files, database connection strings, and API keys for services like Slack and Stripe.
It also crawls local disks for SSH keys, .env files, database connection strings, and API keys for services like Slack and Stripe.
including npm authentication tokens, cloud provider credentials (AWS IMDS/ECS, Vault, Kubernetes), SSH private keys
including npm authentication tokens, cloud provider credentials (AWS IMDS/ECS, Vault, Kubernetes)
It parses local config files for npm and GitHub credentials, and scans system environments for AWS keys, Kubernetes secrets, and vault access tokens.
The malware searches infected development systems and CI/CD runners for credentials that could grant it access to additional source code repositories and npm packages... AWS credentials... Kubernetes secrets... HashiCorp Vault tokens and KV secrets... Azure, and GCP credentials.
its command-and-control endpoint uses an Ethereum dead-drop, letting operators repoint infrastructure without shipping a hardcoded domain.
12 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A self-propagating npm supply-chain worm that compromises packages via maintainer account takeover, executes through a hidden preinstall script, steals npm, GitHub, AWS, Kubernetes, Vault, SSH, .env, database, and API credentials, exfiltrates them, and uses stolen npm tokens to publish backdoored updates to other packages.
A self-propagating npm supply-chain malware that compromises packages, executes automatically via a preinstall script, drops and runs an obfuscated JavaScript payload, steals developer and cloud credentials, exfiltrates them to attacker-controlled infrastructure, and spreads by abusing stolen tokens to infect additional repositories and packages.
An automated npm worm that republishes legitimate packages under hijacked maintainer credentials, adds obfuscated loaders via the preinstall hook, downloads a second stage using bun, steals developer and CI/CD secrets, and uses harvested npm tokens to self-propagate. It also uses an Ethereum dead-drop for command-and-control indirection.
Self-propagating npm ecosystem worm that compromises legitimate packages using stolen maintainer credentials or tokens. The malicious package versions execute during npm install via a preinstall script, download a runtime, run an obfuscated second-stage payload, use an Ethereum dead-drop C2 mechanism, and harvest CI/CD credentials such as npm tokens, cloud credentials, SSH keys, and CI secrets.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.