The ChainDrop campaign began with the compromise of a maintainer's GitHub account for packages in the keyv and cacheable namespaces, resulting in the infection of 440 NPM packages and over 2,200 malicious versions published. The malware executes during package installation, dropping an information stealer that searches for secrets on developer workstations and CI/CD environments. It exfiltrates data to dynamic HTTPS endpoints or attacker-created GitHub repositories. Using stolen credentials, the malware authenticates to multiple services (NPM, GitHub, AWS, Kubernetes, HashiCorp Vault) to enumerate and steal secrets, then repackages and republishes infected packages to propagate further. It also injects malicious configuration files into repositories to maintain persistence and enable developer-to-developer infection. The malware uses an Ethereum blockchain for command-and-control and implements a dead-man’s switch that deletes its state if the stolen GitHub token becomes invalid. The attack affected packages with over 500 million weekly downloads, posing a significant risk to the JavaScript ecosystem.

The attack compromises developer machines and CI/CD environments, leading to theft of a wide range of credentials and secrets across multiple platforms and services. This enables attackers to republish malicious packages, infect additional repositories, and maintain persistence in development environments. The widespread infection of popular NPM packages with hundreds of millions of weekly downloads increases the risk of supply chain compromise across the JavaScript ecosystem. The malware’s use of blockchain for command-and-control and self-clearing mechanisms complicates detection and eradication efforts.

No official patch or fix is available since this is a supply chain compromise involving multiple packages. Developers who installed any infected package versions should assume their machines and CI/CD environments are compromised. Recommended actions include removing the malware, rebuilding CI runners and build machines, revoking and rotating all potentially compromised credentials (NPM, GitHub, cloud services), and auditing GitHub repositories for anomalous activity. Affected systems should be isolated, and relevant logs and package tarballs preserved to bound the exposure window. Monitoring for suspicious package versions and avoiding use of compromised packages is critical.