A self-propagating npm package worm dubbed ChainDrop has poisoned more than 440 packages with over 2,200 malicious versions in a campaign that steals developer credentials and uses them to republish malware, according to analyses published by Microsoft, JFrog, Socket, StepSecurity, and other security vendors. The worm, a fresh variant of the Shai-Hulud family, spreads through the npm install process and reaches beyond package registries into GitHub, cloud, and infrastructure accounts.
How ChainDrop Spreads Through npm Install and Stolen Identities
The campaign began when attackers used a compromised GitHub account belonging to the maintainer of packages in the keyv and cacheable namespaces to publish 11 malware carriers. When a developer installs one of the poisoned packages, a preinstall lifecycle hook downloads a standalone Bun runtime along with roughly 710 KB of obfuscated second-stage code that executes during installation, before the package manager finishes resolving the dependency tree.
Credential Theft Across npm, GitHub, and Cloud Infrastructure
The malware steals npm, GitHub, cloud, and infrastructure credentials, then uses the recovered identities to authenticate to npm, GitHub, AWS, Kubernetes, and HashiCorp Vault to enumerate packages, repositories, workflow secrets, cloud parameters, and secret-store values, according to Microsoft’s analysis. Researchers observed more than 2,200 malicious iterations published within a four-hour window on a single day, and the initial poisoning wave led to 433 additional packages being infected.
Stolen Tokens, GitHub Actions, and Developer-to-Developer Propagation
ChainDrop uses stolen npm tokens to republish poisoned versions of packages and stolen GitHub credentials together with GitHub Actions to infect more repositories. It also injects configuration files for Claude (.claude) and VS Code (.vscode) so that the worm persists and spreads when developers share or sync their configuration, a technique aimed at reaching both human developers and AI coding agents that consume the same project metadata.
EtherHiding Command-and-Control and the Scope Discrepancy
Like earlier Shai-Hulud versions, ChainDrop uses the Ethereum blockchain for command-and-control through the EtherHiding technique, storing C2 addresses in blockchain transactions that are difficult for defenders to disrupt. Exfiltrated data is encrypted and sent either to a dynamic HTTPS endpoint or to attacker-created public GitHub repositories whose descriptions read “Shai-Hulud: Here We Go Again.”
Widely Varying Footprint Figures Across Security Vendors
The reported scale of the campaign differs substantially by source. One accounting cites more than 2,200 malicious versions of 440 packages with a combined 500 million weekly downloads, while other researchers describe a footprint of 1,300 or more packages with 2 billion combined monthly downloads. Independent verification efforts also diverge: SafeDep confirmed 353 poisoned versions across 79 package names, while Aikido reported at least 868 packages affected.
Dead-Man’s Switch and the Self-Propagating Design
The worm includes a host-level dead-man’s switch that polls the GitHub API using the victim’s own token every 60 seconds and deletes its state and exits if the token stops working, and it self-clears after 24 hours, according to Socket’s analysis. The design combines a modular dispatcher with separate GitHub and domain delivery channels, autostart hooks in developer configuration files, and a propagation loop that requires no further attacker interaction once the first token is stolen.
What ChainDrop Means for the npm Ecosystem
The campaign’s reach from npm into GitHub Actions, cloud providers, and configuration files means any developer who installed an affected package must treat the machine as compromised. The recommended response from the analyzing vendors is to isolate affected systems, remove the malware, rebuild CI runners, rotate or revoke potentially compromised credentials, and audit GitHub repositories for unexpected changes.
Researchers have also called for package registries to move beyond two-factor authentication toward permission-based package controls and to block install scripts by default, since the preinstall hook is the mechanism that makes the worm self-propagating. The Shai-Hulud lineage has been active before, but ChainDrop’s use of AI-agent configuration files marks a shift toward reaching developers through the same tooling they use to automate their work.
The conflicting scope figures across vendors show how hard it is to measure a fast-moving worm campaign, and the four-hour burst of 2,212 malicious versions indicates the operators can rebuild the entire attack set faster than any single registry takedown. For organizations that rely on npm, the incident shows that package installation is code execution, and that the credentials stored in a developer’s environment are a direct path into production infrastructure when a dependency is compromised.
