Loading story…
A self-propagating npm supply-chain attack dubbed ChainDrop has spread through compromised package releases, with malicious versions using preinstall scripts to execute obfuscated files such as setup.mjs and math_init.js, download a runtime, and launch a second-stage payload. Researchers said the campaign hit many unrelated maintainer scopes in a short period, indicating automated propagation through stolen maintainer credentials or tokens, and described the malware as a CI/CD credential harvester that uses Bun-loaded components and Ethereum dead-drop command-and-control.
StepSecurity said its OSS Security Feed flagged dozens of npm packages as critical during the outbreak and warned that the published list may be incomplete. The broader feed also highlighted recurring npm ecosystem risks including typosquatting, dropped provenance, repository mismatches, and install-time binary downloads, including a critical case where free-email-domains v1.9.15 fetched content from the typosquatted domain hubspotusercontent40.net during postinstall. Defenders were urged to treat any environment that installed affected versions as compromised, rotate secrets, roll back to known-good releases, and inspect developer endpoints, CI runners, and package caches for persistence.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
14 events from the most recent confirmed update back to the earliest known activity.
Researchers reported that ChainDrop exfiltrated stolen data to a public GitHub repository described as "Shai-Hulud: Here We Go Again" and to the domain npm-cache[.]com, which Wiz identified as a reliable indicator of compromise. The update also warned that any workstation or CI/CD runner that installed an infected package should be treated as fully compromised.
CERT-SE published a security notice warning that the self-replicating Chaindrop malware was spreading through the JavaScript and npm ecosystem and affecting more than 400 packages. The advisory told organizations to investigate possible exposure, avoid running npm install or npm update until maintainers confirm releases are clean, and rotate secrets in affected environments.
Microsoft Threat Intelligence reported that ChainDrop republished malicious npm packages by modifying package tarballs directly, often without matching source commits, and used stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories for persistence and secondary spread. The report also documented HTTPS and GitHub-based exfiltration paths and warned that packages published through trusted GitHub Actions workflows could still carry valid provenance.
Expel reported that the ChainDrop payload belongs to the Mini Shai Hulud/Shai Hulud npm worm family. The report said the same malware lineage had previously affected TanStack, Mistral AI, and OpenSearch packages in May 2026, adding a new attribution link for the campaign.
Researchers reported that after compromising the Keyv maintainer's GitHub account, the attacker pushed malicious files to affected projects' main branches and generated poisoned npm releases through legitimate GitHub Actions workflows. As a result, the malicious packages carried valid provenance information despite containing the preinstall dropper and infostealer payloads.
Reporting on the ChainDrop npm supply-chain campaign said the compromise had affected 2,212 projects and 444 victims. The update also highlighted heavily downloaded compromised packages including keyv, flat-cache, and file-entry-cache, indicating broader downstream impact than previously documented.
On August 4, 2026, attackers compromised the GitHub account of the maintainer behind keyv and related caching packages, then pushed malicious releases with a preinstall dropper and credential-stealing payload. By 13:20 CEST, researchers had confirmed at least 868 compromised packages spanning 1,381 versions, marking a major escalation of the ongoing npm worm campaign.
Between approximately 09:50 and 10:50 UTC on 2026-08-04, StepSecurity's OSS Security Feed flagged dozens of npm package releases as critical and identified them as compromised. The affected versions spanned many unrelated maintainer scopes, indicating a rapidly spreading campaign.
Semgrep reported that the earliest known malicious ChainDrop package release was keyv@6.0.0 at 09:35:00Z, marking the first observed publication in the npm worm campaign. The release used the same preinstall-based loader pattern later seen across the broader compromise wave.
After the ChainDrop compromise, keyv version 6.0.0 was restored with legitimate code. The restored release was published using npm Trusted Publishers and included SLSA provenance protections.
StepSecurity reported that ChainDrop's apparent objective was to steal CI/CD-related secrets, including npm tokens, cloud credentials, SSH keys, and other CI secrets. The investigation also found the malware used an Ethereum dead-drop mechanism for command-and-control.
The breadth of compromised packages across unrelated maintainer scopes led investigators to assess the propagation as likely automated, potentially using stolen maintainer credentials or tokens. They also said they were analyzing the payload, command-and-control infrastructure, and propagation mechanism while coordinating with npm and affected maintainers.
StepSecurity reported an active npm ecosystem incident involving a self-propagating worm dubbed ChainDrop. The compromised releases added obfuscated files such as setup.mjs and math_init.js, executed automatically via preinstall scripts, downloaded a runtime, and launched a second-stage payload.
StepSecurity's OSS security feed assessed free-email-domains v1.9.15 as a critical risk after finding a postinstall script that automatically fetched content from the typosquatted domain hubspotusercontent40.net and wrote it into domains.json. The review said this created a supply-chain attack path that could enable payload delivery, backdoor injection, metadata exfiltration, or victim-specific targeting.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
16 references tracked. Mallory keeps watching after this page renders.
acn.gov.it
Open sourcexakep.ru
Open sourcecert.se
Open sourcesecurityweek.com
Open sourcesemgrep.dev
Open sourcecyberveille.ch
Open sourcedocs.npmjs.com
Open sourceapp.stepsecurity.io
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
A large-scale supply chain attack has targeted the Node Package Manager (NPM) ecosystem, compromising hundreds of widely used JavaScript packages and threatening the security of software development pipelines globally. In mid-September, cybersecurity researchers identified a self-propagating malware dubbed "Shai-Hulud," which was distributed through trojanized NPM packages, including some with millions of weekly downloads and high-profile packages such as those from CrowdStrike. The attack leveraged a malicious "bundle.js" script that downloaded and executed TruffleHog, a legitimate credential scanner, to harvest developer and CI/CD tokens, cloud service credentials, and environment variables from compromised systems. The stolen credentials were exfiltrated via hard-coded webhooks and GitHub Actions workflows, enabling the attacker to further propagate the malware and gain unauthorized access to sensitive resources. The campaign affected both Windows and Linux systems, increasing its reach and impact across diverse development environments. Sysdig reported that the attack on September 15 involved approximately 200 compromised packages, including @ctrl/tinycolor, and was linked to an attacker who had previously targeted Nx packages in late August. The worm not only stole secrets but also published them publicly on GitHub and attempted to make victim repositories public, amplifying the risk of further compromise. Earlier in the month, other popular packages such as chalk, debug, and duck were also compromised following a successful spear phishing attack against a maintainer, with the attacker seeking to redirect cryptocurrency payments. NPM responded by removing the malicious package versions, but users were required to update or revert to secure versions to mitigate the risk. Sysdig provided same-day threat intelligence and detection capabilities to its customers, including open source Falco rules to identify and respond to the threat. The attack demonstrated the vulnerability of even the most trusted and widely used open source packages, highlighting the importance of continuous monitoring and rapid response in the software supply chain. Security researchers and vendors emphasized the need for organizations to scan their environments for known malicious packages, such as dist.fezbox.cjs, and to review logs for signs of credential exfiltration. The incident underscored the evolving tactics of threat actors targeting developer ecosystems, using advanced techniques to automate propagation and maximize impact. Organizations relying on NPM packages and CI/CD pipelines were urged to remain vigilant, update dependencies promptly, and leverage threat intelligence resources to defend against similar attacks. The Shai-Hulud campaign remains an evolving threat, with ongoing analysis and mitigation efforts by the security community. This incident serves as a stark reminder that popularity and trust in open source packages do not guarantee safety, and proactive security measures are essential to protect software supply chains from compromise.
Jun 29, 2026
Threat actors are using **malicious npm packages** to steal developer credentials and CI/CD secrets, enabling rapid escalation into cloud environments. Google reported that **UNC6426** leveraged keys stolen during the earlier compromise of the *nx* npm ecosystem to pivot from a stolen developer GitHub token into **AWS administrative access within 72 hours**, abusing **GitHub-to-AWS OpenID Connect (OIDC) trust** to create a new admin role. The actor then used that access to **exfiltrate data from AWS S3** and conduct **destructive actions** in production cloud environments; the initial *nx* compromise involved a GitHub Actions `pull_request_target` workflow abuse (“**Pwn Request**”) that enabled publishing trojanized packages containing a `postinstall` chain that executed the **QUIETVAULT** JavaScript credential stealer and uploaded stolen data to a public GitHub repo (`/s1ngularity-repository-1`). Separately, researchers reported new waves of the **PhantomRaven** npm supply-chain campaign distributing **88 additional malicious packages** (via ~50 disposable accounts) that target JavaScript developers by exfiltrating secrets from files like `.gitconfig` and `.npmrc`, environment variables, and CI/CD tokens (e.g., GitHub/GitLab/Jenkins/CircleCI). The campaign uses **slopsquatting** (LLM-suggested lookalike package names) and a stealth technique called **Remote Dynamic Dependencies (RDD)**, where `package.json` pulls a dependency from an external URL so the malicious payload is fetched at install time (`npm install`) and can evade static package inspection; researchers indicated many of these packages remained available in the npm registry at the time of reporting.
Jun 29, 2026
Open-source software supply chain risk continued to escalate, with reporting citing **454,600+** newly identified malicious packages across major repositories (including **PyPI, npm, Maven Central, NuGet, and Hugging Face**) and tactics ranging from **credential theft** to **multi-stage attacks** and even early **self-replicating** package malware. The activity reportedly concentrated heavily in **npm**, including high-volume “ecosystem flooding” (e.g., single accounts publishing **150,000+** malicious packages in days) and **hijacking of trusted projects**, exploiting developer reliance on superficial trust signals such as package names, READMEs, and download counts. Separately, researchers disclosed **“PackageGate”** vulnerabilities in JavaScript package managers (**npm, pnpm, vlt, and Bun**) that can bypass common post-incident defenses—namely `--ignore-scripts` and lockfile integrity—enabling malicious code execution via compromised dependencies. Koi Security reported six issues; **pnpm, vlt, and Bun** shipped fixes, while **npm** reportedly treated the behavior as expected. In parallel, threat actors abused **GitHub’s fork architecture** to distribute a spoofed *GitHub Desktop* installer promoted via search ads; execution deployed **HijackLoader** and established persistence via a **scheduled task**, underscoring that supply chain threats extend beyond package registries into developer tooling distribution channels.
Jun 29, 2026