MalwarePublished 6 Aug 2026

ChainDrop: Inside a Self-Propagating npm Worm

Source Palo Alto Unit 42

Description

Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2 routing. The post ChainDrop: Inside a Self-Propagating npm Worm appeared first on Unit 42 .

Impact

The worm can compromise GitHub Actions runners by stealing secrets, potentially leading to unauthorized access to repositories or cloud resources. Its propagation through npm packages risks widespread infection in JavaScript projects that consume compromised packages. The use of Ethereum smart contracts for C2 adds complexity to detection and takedown efforts, increasing the persistence and stealth of the malware.

Defensive guidance

No specific patch or fix is indicated in the available data. Users should review dependencies for suspicious or untrusted npm packages and audit GitHub Actions workflows for leaked secrets. Monitoring for unusual activity in CI/CD pipelines and restricting secret exposure in runners are recommended. Since this is a supply chain threat, vigilance in package sourcing and integrity verification is critical.

References

unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 6 Aug 2026, 22:40 UTC

References

Community reviews

Related threats