MalwarePublished 11 Aug 2026

Self-Propagating ChainDrop Worm Infects More Than 400 npm Packages in Major Software Supply Chain Attack

Source AlienVault OTX General

Description

A large-scale software supply chain attack compromised over 400 npm packages through a self-propagating worm called ChainDrop, a new variant of Mini Shai-Hulud. The campaign exploits stolen npm publishing credentials to automatically modify and republish legitimate software releases. ChainDrop targets developer workstations and CI/CD environments, harvesting credentials from npm, GitHub, AWS, Kubernetes, and HashiCorp Vault before validating access and enumerating resources. The malware uses preinstall lifecycle scripts for automatic execution, establishes persistence through repository configuration modifications, and abuses GitHub Actions OIDC trusted publishing workflows. After stealing credentials, it autonomously propagates by downloading packages, inserting malicious payloads, and republishing them with incremented versions, demonstrating how compromised developer identities can enable widespread ecosystem compromise.

Impact

The attack compromises the integrity of over 400 npm packages by injecting malicious payloads, potentially affecting any software relying on these packages. It enables attackers to steal credentials from multiple critical platforms (npm, GitHub, AWS, Kubernetes, HashiCorp Vault), which can lead to further unauthorized access and resource enumeration. The self-propagating nature of the worm allows rapid and widespread infection across the software supply chain, increasing the risk to developers and downstream users of affected packages.

Defensive guidance

Since this attack exploits stolen credentials and abuses CI/CD workflows, mitigation should focus on securing developer credentials, enforcing multi-factor authentication, auditing and restricting CI/CD pipeline permissions, and monitoring for unauthorized package modifications. Developers should verify the integrity of npm packages before use and consider implementing supply chain security best practices such as signing packages and using trusted sources. Check vendor advisories and npm security updates for any official guidance or fixes.

Summary

ChainDrop is a large-scale software supply chain malware campaign that compromises npm packages by leveraging stolen publishing credentials. It operates as a self-propagating worm, infecting developer workstations and CI/CD pipelines to harvest credentials from various cloud and development platforms. The malware uses lifecycle scripts to execute automatically during package installation and establishes persistence through repository configuration changes and abuse of GitHub Actions OIDC trusted workflows. It then autonomously downloads npm packages, injects malicious code, increments version numbers, and republishes them, thereby spreading the infection across the npm ecosystem. This attack demonstrates how compromised developer identities and CI/CD environments can facilitate extensive supply chain compromises.

Self-Propagating ChainDrop Worm Infects More Than 400 npm Packages in Major Software Supply Chain Attack

Description

Impact

Defensive guidance

Summary

Indicators of compromise

Hashes 3

Community reviews

Description

AI analysisMachine-generated, updated 11 Aug 2026, 15:48 UTC

MITRE ATT&CK techniques20 from threat tags

Technical details

Indicators of compromise

Hashes 3

Community reviews

Related threats