CHAINDROP is a self-propagating worm deployed in a supply chain attack that compromised the keyv npm package maintainer. It infects npm packages by leveraging stolen npm credentials to publish trojanized versions. The worm executes via preinstall hooks across multiple operating systems and harvests credentials from over 300 patterns targeting AI tooling, cloud providers, GitHub tokens, and npm credentials. Its command and control infrastructure uses Ethereum smart contracts for resolution. The malware payload is heavily obfuscated and contains thematic references consistent with the Shai-Hulud adversary group. Over 400 npm packages were infected, affecting a large user base with over 1.3 billion monthly downloads. Indicators include malicious domains and multiple file hashes. No CVE or patch information is available.

The attack compromises the integrity of widely used npm packages, potentially allowing attackers to execute arbitrary code on systems where infected packages are installed. Credential harvesting capabilities enable further compromise of developer and cloud environments. The widespread infection affects a significant portion of the npm ecosystem, risking supply chain trust and exposing users to backdoors and data theft. The multi-platform execution increases the scope of affected environments.

No official patch or remediation guidance is provided in the available data. Since this is a supply chain compromise involving npm packages, mitigation should focus on auditing and verifying package integrity, rotating any potentially exposed credentials (npm, GitHub, cloud providers), and monitoring for use of the identified malicious indicators such as domains and file hashes. Users should avoid installing or updating packages from compromised maintainers until the issue is resolved. Check the referenced vendor advisory and npm security announcements for updates and official remediation steps.