- ChainDrop has compromised more than 1,300 packages with a combined 2 billion monthly downloads on the Node Package Manager (npm) registry.
- Keyv and Cacheable are among the infected packages, which include popular caching utilities from the same maintainer.
- The attack began after the threat actor compromised the GitHub account of Keyv’s maintainer, spreading to packages associated with major organizations.
- The ChainDrop npm worm is described as a Bun-loaded CI/CD credential harvester with an Ethereum dead-drop C2.
- Aikido reports that at least 868 packages (across 1381 versions) have been compromised by the worm.
- The malicious files pushed to the projects’ main branches included a setup.mjs payload dropper and a Math_Symbol.js script for stealing sensitive information.
- The malware is heavily obfuscated and includes self-spreading capabilities that allow it to infect packages from other maintainers.
- The setup.mjs dropper downloads the Bun JavaScript runtime to execute the Math_Symbol.js payload, which has infostealing capabilities.
- The malware collects developer and cloud credentials from the compromised environment and sends them to a public GitHub repository.
- The command-and-control domains are resolved from the Ethereum blockchain, allowing for dynamic updates.
A self-propagating npm worm called ChainDrop has compromised over 1,300 packages on the Node Package Manager (npm), affecting organizations like Deliveroo and ServiceTitan. The attack began when a GitHub maintainer's account was hijacked, allowing the worm to spread rapidly.13
The worm has been linked to over 2 billion monthly downloads and has infected popular packages such as Keyv and Cacheable. According to Aikido, at least 868 packages across 1,381 versions have been compromised. The attacker pushed malicious files directly to the main branches of these projects, generating new package releases that carried valid provenance information.256
The malicious packages contain two files: the setup.mjs payload dropper and the Math_Symbol.js script for stealing sensitive information. The setup.mjs dropper downloads the Bun JavaScript runtime to execute the infostealer script, which collects developer and cloud credentials and sends them to a public GitHub repository.8
The worm's command-and-control (C2) domains are resolved from an Ethereum smart contract, allowing it to rotate domains at will. This sophisticated attack has expanded its targets for credential theft by nearly 70%, including AI-agent credential stores and cryptocurrency keystores.10
As the attack is ongoing, experts recommend using dependency allowlisting, integrity checks, and provenance controls to mitigate risks.
“ChainDrop spreads by harvesting GitHub tokens, cloud credentials, and CI/CD secrets from infected developer machines and runners, exfiltrating them to npm-cache[.]com, which Wiz flags as a strong indicator of compromise. Aikido counts at least 868 packages across 1,381 versions, including popular caching utilities Keyv, flat-cache, and file-entry-cache.”
