ChainDrop Self-Propagating npm Worm Targeting CI/CD and Cloud Credentials

On August 4, 2026, a massive supply chain attack was identified targeting the npm ecosystem, primarily affecting popular packages including `keyv`, `flat-cache`, and `file-entry-cache`. Attributed to the Shai-Hulud 2.0/ChainDrop lineage, the campaign initially compromised a high-profile GitHub maintainer account to publish trojanized packages with valid SLSA provenance signed by GitHub Actions. The worm quickly propagated to over 400 unique packages across multiple organizations, reaching over 2 billion monthly installs by leveraging stolen npm publishing tokens harvested from victims.

The technical chain involves a `preinstall` dropper (`setup.mjs`) that downloads the Bun JavaScript runtime to execute a heavily obfuscated 728 KB second-stage payload (`Math_Symbol.js` or `math_init.js`). This payload harvests a wide array of credentials, including AWS IAM roles, Kubernetes secrets, HashiCorp Vault tokens, and GitHub Actions runner memory. Advanced features include command-and-control (C2) resolution via an Ethereum smart contract (EtherHiding), RSA-encrypted exfiltration, and persistence mechanisms targeting AI development tools like Claude Code and VS Code.

This incident highlights a critical shift in supply chain threats where attackers utilize legitimate infrastructure (OIDC Trusted Publishing) to bypass traditional provenance-based security gates. Organizations are urged to audit lockfiles for affected versions, rotate all potentially exposed secrets, and clear persistence hooks in `.claude` and `.vscode` directories immediately.