ChainDrop npm Worm Compromises Packages via Preinstall Credential Harvester

A self-propagating npm supply-chain attack dubbed ChainDrop has spread through compromised package releases, with malicious versions using preinstall scripts to execute obfuscated files such as setup.mjs and math_init.js, download a runtime, and launch a second-stage payload. Researchers said the campaign hit many unrelated maintainer scopes in a short period, indicating automated propagation through stolen maintainer credentials or tokens, and described the malware as a CI/CD credential harvester that uses Bun-loaded components and Ethereum dead-drop command-and-control.

StepSecurity said its OSS Security Feed flagged dozens of npm packages as critical during the outbreak and warned that the published list may be incomplete. The broader feed also highlighted recurring npm ecosystem risks including typosquatting, dropped provenance, repository mismatches, and install-time binary downloads, including a critical case where free-email-domains v1.9.15 fetched content from the typosquatted domain hubspotusercontent40.net during postinstall. Defenders were urged to treat any environment that installed affected versions as compromised, rotate secrets, roll back to known-good releases, and inspect developer endpoints, CI runners, and package caches for persistence.