ChainDrop npm Worm: Self-Propagating Supply Chain Attack & Credential Theft Analysis

Vulnerability Overview ChainDrop npm Worm: Attackers modified malicious scripts in package manifests to download and silently launch a 727 KB obfuscated payload. Data Exfiltration: A hidden Python script directly reads the memory of GitHub Actions runners, stealing temporary OpenID Connect (OIDC) tokens and keys, as well as local developer credentials. Self-Propagation: Leveraging stolen tokens and GitHub tokens for self-replication, it silently infects and republishes additional packages while maintaining legitimate functionality to avoid detection by developers. Persistence: Achieves long-term persistence by establishing cross-linking hooks directly within developer tools (such as VS Code and Claude Code), and dynamically manages its command and control (C2) infrastructure via Ethereum blockchain transactions. Impact Scope Affected Packages: Over 400 packages, including popular libraries such as and . Attack Stages: The attack occurs at every stage of the Software Development Life Cycle (SDLC), including CI/CD pipelines and development environments. Attack Surface: - Endpoint Attack Surface: Developer tools (e.g., VS Code's ) are modified, allowing attackers to retain access even after builds are completed. - CI/CD Pipelines: External tools, plugins, and helper scripts relied upon by build pipelines are exploited, such as the compromise of Trivy. - Cloud Runtime: Vulnerabilities in the underlying operating system layer of container environments (such as OpenSSL) can lead to remote takeover. Remediation Disable Lifecycle Installation Scripts: Use to disable lifecycle installation scripts. Enforce Package Cooling Periods: Implement package cooling periods and restrict CI/CD egress traffic. Use Ephemeral CI/CD Servers: Utilize ephemeral CI/CD servers and pin dependencies to specific commit SHAs. Transition to OIDC Authentication: Establish an unbreakable trust chain by transitioning to short-lived OIDC authentication and end-to-end attestation proofs. Continuous Visibility: Maintain continuous visibility across local development endpoints, automated pipelines, and cloud workloads to intercept malicious behavior and prevent compromise before propagation. Related Resources ChainDrop: Inside a Self-Propagating npm Worm Token Jacking: Cybercriminals Could Be Stealing Your AI Resources The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15) Tags ChainDrop Npm packages Software supply-chain attack Supply chain Related General Resources Threat Brief: Mitigating Large-Scale Credential Attacks (Updated August 15, 2026) The Frontier AI Vulnerability Burst: Industrializing Autonomous... How We Added WebAuthn to a Browser-Based RDP Client Subscription Subscribe to Email Updates: Subscribe to Unit 42 Threat Research email updates. Products & Services AI-Powered Network Security Platform Secure AI by Design Prisma AIR AI Access Security Cloud Delivered Security Services Advanced Threat Prevention Next-Generation Firewalls Hardware Firewalls Software Firewalls Strata Cloud Manager SD-WAN for NGFW AI-Driven Security Operations Platform Cloud Security Cortex Cloud Application Security Cloud Posture Security Cloud Runtime Security Next-Generation Identity Security Privileged Access Management Identity and Access Management Endpoint Privilege Manager Identity Governance Workforce Password Management Aeronetic Identities

Goal Reached Thanks to every supporter — we hit 100%!

ChainDrop npm Worm: Self-Propagating Supply Chain Attack & Credential Theft Analysis

More from this source