Inside a Self-Propagating npm Worm

A self-propagating npm worm dubbed ChainDrop infected over 400 packages downloaded hundreds of millions of times weekly, including popular packages like keyv and cacheable-request. The worm steals cloud credentials, npm and GitHub tokens, SSH keys, and sensitive developer data while extracting temporary credentials from GitHub Actions runner memory. It uses stolen npm publishing tokens to infect additional packages while maintaining their legitimate functionality. The attackers established persistence through VS Code and Claude Code configurations, employed blockchain-based command-and-control resolution via Ethereum smart contracts, and can execute attacker-supplied code. The operator demonstrated ability to silently reconfigure C2 infrastructure through Ethereum transactions without updating deployed instances. ChainDrop employs three layers of obfuscation and encryption, exfiltrates data through encrypted channels, and publishes stolen tokens in public commit messages.

• TensorLake npm SDK Compromised in ChainDrop Shai-Hulud Credential-Stealing AttackCampaign2026-10-08
• Tracking Shai-Hulud: Inside the ChainDrop NPM WormMalware2026-08-12
• Summary of Malicious Program Distribution via Goddess of Victory: NIKKE PC LauncherMalware2026-11-05
• Poisoned Source: APT29 Watering Holes Targets Mobile DevicesMalware2026-11-04
• Polymarket Breach Alert: Wallet-Draining Code Found in a Third-Party ScriptCampaign2026-10-30