ChainDrop is a large-scale software supply chain malware campaign that compromises npm packages by leveraging stolen publishing credentials. It operates as a self-propagating worm, infecting developer workstations and CI/CD pipelines to harvest credentials from various cloud and development platforms. The malware uses lifecycle scripts to execute automatically during package installation and establishes persistence through repository configuration changes and abuse of GitHub Actions OIDC trusted workflows. It then autonomously downloads npm packages, injects malicious code, increments version numbers, and republishes them, thereby spreading the infection across the npm ecosystem. This attack demonstrates how compromised developer identities and CI/CD environments can facilitate extensive supply chain compromises.

The attack compromises the integrity of over 400 npm packages by injecting malicious payloads, potentially affecting any software relying on these packages. It enables attackers to steal credentials from multiple critical platforms (npm, GitHub, AWS, Kubernetes, HashiCorp Vault), which can lead to further unauthorized access and resource enumeration. The self-propagating nature of the worm allows rapid and widespread infection across the software supply chain, increasing the risk to developers and downstream users of affected packages.

No official patch or remediation is indicated in the provided data. Since this attack exploits stolen credentials and abuses CI/CD workflows, mitigation should focus on securing developer credentials, enforcing multi-factor authentication, auditing and restricting CI/CD pipeline permissions, and monitoring for unauthorized package modifications. Developers should verify the integrity of npm packages before use and consider implementing supply chain security best practices such as signing packages and using trusted sources. Check vendor advisories and npm security updates for any official guidance or fixes.