ChainDrop Publishes Initial Malware Without Stealing a Long-Lived npm Token

The ChainDrop campaign has exposed a gap in modern software supply-chain defenses: malware no longer needs a durable npm publishing token or even an npm install event to spread through developer environments.

The self-propagating npm worm, also tracked as a Mini Shai-Hulud variant, turned compromised publisher and CI identities into a distribution mechanism while establishing execution paths inside trusted repository configuration.

On August 4, attackers compromised the GitHub account behind keyv, a widely used npm caching library, and associated projects including cacheable, flat-cache, cache-manager, and file-entry-cache.

From that foothold, they published malicious releases containing a heavily obfuscated Bun-based payload.

The worm harvested npm, GitHub, cloud, Kubernetes, Vault, SSH, and CI/CD credentials, then used valid publishing access to modify package tarballs, add a preinstall hook, increment the patch version, and republish them.

The scale was substantial. Microsoft described a campaign affecting more than 400 packages across unrelated publishers, while researchers cautioned that the total number of affected artifacts remained fluid as the worm propagated.

Core affected packages represented more than two billion combined monthly downloads, making the incident consequential even where direct installs were limited.

What makes ChainDrop technically distinct is its repository-level persistence. After stealing GitHub credentials, the malware injected .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json, and .vscode/setup.mjs into accessible repositories.

The VS Code task was configured to run when a folder opened, while the Claude Code configuration used a SessionStart hook.

Medium Researchers said that, each configuration referenced a dropper stored in the other tool’s directory, a cross-linking choice designed to make the files appear less suspicious during casual review.

This creates an execution path outside the dependency tree. A developer can clone a compromised repository, open it in VS Code, or initiate a Claude Code session and trigger the dropper without installing dependencies or running a build.

ChainDrop Exploits npm

Workspace-trust controls limit automatic task execution in untrusted projects, but that protection is far less useful for repositories developers have already marked as trusted.

Conventional dependency scanners are poorly placed to catch this activity. Their purpose is to inspect manifests, lockfiles, package metadata, and known vulnerable artifacts.

ChainDrop’s IDE hooks are repository-supplied operational configuration, not declared dependencies.

The campaign therefore shifts the security boundary from the package registry to the repository checkout itself: git clone may now deliver executable instructions to development tooling.

The incident also undermines a common overreliance on provenance. ChainDrop contained a targeted path that could obtain npm publishing authority through GitHub Actions OpenID Connect trusted publishing, then generate authentic Sigstore provenance for the modified tarball.

The signature would be cryptographically valid because the legitimate workflow identity produced it. Provenance confirms the origin of an artifact, not the integrity of the source, runner, workflow, or credentials that created it.

Defenders should treat any installation of a confirmed malicious version as a potential endpoint and CI compromise.

Investigation should include poisoned lockfiles, package caches, artifact mirrors, unexpected preinstall entries, setup.mjs, Math_Symbol.js or math_init.js, and unauthorized .claude or .vscode configuration changes.

Credentials reachable from impacted systems should be revoked and rotated from clean infrastructure, while affected runners and developer hosts should be rebuilt rather than merely cleaned.

ChainDrop’s enduring lesson is simple: repository configuration has become executable supply-chain content. Security programs that monitor only package installation will miss the next attack before it ever reaches npm install.

[Live Webinar] Join Elastic & UnderDefense to learn how small security teams can unify AI visibility and agentic response into one operating model. -> Register Now