ChainDrop is a self-propagating malware worm that infected more than 1,300 npm packages, including popular caching utilities, by compromising the GitHub account of a package maintainer. The attacker pushed malicious files directly to main branches and released compromised versions through legitimate GitHub Actions workflows, preserving valid provenance. The infected packages contain a setup.mjs dropper that downloads the Bun JavaScript runtime to execute an obfuscated infostealer script (Math_Symbol.js or math_init.js). This script collects extensive sensitive data such as environment variables, GitHub tokens, npm tokens, cloud credentials (AWS, Azure, GCP), Kubernetes secrets, HashiCorp Vault tokens, database credentials, and private keys. Collected data is encrypted and exfiltrated to a public GitHub repository. The malware also has self-spreading capabilities, infecting other packages that depend on compromised ones. The domain npm-cache[.]com is used for data exfiltration. The attack is ongoing and detection is complicated by the use of legitimate build and release processes.

The attack compromises developer and CI/CD environments by stealing a broad range of sensitive credentials and secrets, potentially allowing attackers to access additional source code repositories, npm packages, cloud infrastructure, and other critical systems. The use of legitimate GitHub workflows to publish malicious packages undermines trust in package provenance and increases the risk of widespread supply-chain compromise. Systems that installed affected package versions are considered compromised, even if the malicious packages are later removed, requiring full environment rebuilds and credential rotations to mitigate.

No official vendor patch is available as this is a supply-chain compromise involving multiple third-party packages. Organizations should assume any environment that installed affected packages is compromised and perform full rebuilds from safe backups or clean sources. All exposed credentials, tokens, and secrets must be rotated immediately. Use dependency allowlisting, integrity verification, and provenance controls to reduce risk. Monitor for indicators of compromise such as the npm-cache[.]com domain and hashes of malicious files provided by security researchers. Review logs and repositories for unauthorized changes. Continue to track updates from security companies providing lists of compromised packages and IoCs.