ChainDrop npm Attack: How Dev Pipelines Became a Weapon

The ChainDrop npm supply chain attack is not a vulnerability; it is a self-replicating weapon that turns trusted developer infrastructure into a credential harvesting engine.

Beginning on August 4, 2026, with the compromise of the popular `keyv` package, this campaign has infected over a thousand downstream packages with more than 2,000 malicious versions. Security researchers at [Mandiant have linked the attack](https://www.mandiant.com/resources/blog/chaindrop-shai-hulud-npm-worm) to an evolved variant of the "Shai-Hulud" worm, previously observed in 2025, with some evidence pointing towards the threat actor known as "TeamPCP." The attack vector is brutally effective: compromise a single developer's GitHub account, push malicious code to a trusted project, and let the project's own CI/CD pipeline, via GitHub Actions, build, sign, and publish the poisoned package to the npm registry with valid, trusted provenance.

Note what this means: The very tools designed to automate and secure software delivery are being used as the primary distribution mechanism for malware. This is a systemic failure of trust. Attackers are no longer just targeting endpoints; they are targeting the automated arteries of modern development, weaponizing the implicit trust developers place in package managers and CI/CD systems. Why does this keep happening? Because the economic incentive to steal cloud, API, and platform credentials at scale far outweighs the security friction of the open-source ecosystem, which still relies heavily on easily compromised personal access tokens.

[Visual Graphic 1]

Anatomy of a Self-Propagating Attack

The ChainDrop npm supply chain attack follows a precise and devastating lifecycle. It begins not with a software flaw, but with a human one: the compromise of a legitimate package maintainer's GitHub account, likely through phishing or previously stolen credentials. This is a classic execution of [Valid Accounts (T1078/001)](https://attack.mitre.org/techniques/T1078/001/), turning a trusted identity into an initial access vector.

Once inside, the attacker pushes malicious code directly to the project's main branch. The payload is typically a dropper script (`setup.mjs`) and an obfuscated infostealer (`Math_Symbol.js`). Crucially, the attacker modifies the `package.json` file, adding a `preinstall` lifecycle hook. This hook ensures the malicious script executes automatically the moment a developer or build server runs `npm install` on a project containing the compromised dependency.

> 🧠 CISO Brief: The use of `preinstall` hooks for code execution is a well-known risk, categorized by MITRE ATT&CK as [Spearphishing Link (T1193)](https://attack.mitre.org/techniques/T1193/) adapted for a package manager context. Your development teams must have policies restricting or auditing the use of these lifecycle scripts in third-party dependencies. The failure to do so is not a technical gap; it is a policy and governance failure.

The project's GitHub Actions workflow, configured to build and publish on new commits, obediently packages this poisoned code. It signs the package with legitimate keys, granting it valid provenance, and publishes the new, malicious version to npm. To a downstream developer or an automated Dependabot-style tool, it looks like a routine patch update from a trusted source. This is the core of the deception.

Once a new victim installs the package, the worm's propagation phase begins. The infostealer harvests all accessible npm publishing tokens. It then uses these tokens to enumerate every package the newly compromised identity has access to, systematically injecting itself, incrementing the version number, and republishing. This cycle repeats, allowing the worm to spread exponentially through the dependency graph. The initial compromise of `keyv@6.0.0` led to the infection of `cacheable@2.5.1`, `flat-cache@6.1.24`, and hundreds more within hours.

This self-propagation turns every victim into an attacker, creating a cascade of compromise that is difficult to trace and contain.

The Credential Heist: What ChainDrop Steals

The primary objective of the ChainDrop worm is not disruption, but mass credential theft from developer environments. The payload is an indiscriminately powerful infostealer that vacuums up a vast array of secrets, turning a single infected developer machine or CI/CD runner into a skeleton key for an entire organization.

According to analysis from [IBM X-Force](https://research.ibm.com/blog/chaindrop-supply-chain-credential-theft), the malware targets and exfiltrates:

* Platform & Package Tokens: npm tokens, GitHub Personal Access Tokens (PATs), workflow tokens, and SSH keys. * Cloud Provider Credentials: AWS keys, Kubernetes configurations (`kubeconfig`), HashiCorp Vault tokens, and credentials for GCP, Azure, and Alibaba Cloud. * API & Service Keys: Stripe and Slack tokens. * AI Tooling Credentials: Secrets for Anthropic, Claude, Codex, OpenAI, and Gemini. * System Environment: The complete process environment and local configuration files (`.git-credentials`, `.npmrc`, etc.).

If you were the CISO here, you would be looking at a multi-domain catastrophe. A single infected CI runner could leak the credentials needed to access production databases, pivot to cloud infrastructure, and exfiltrate customer data. The theft of AI tooling credentials is a particularly modern twist, giving attackers access to proprietary models or the ability to run up enormous bills on high-powered inference APIs.

[Visual Graphic 2]

> ⚠️ BreachModal Insight: The scope of this credential theft highlights the profound failure of secrets management in many development workflows. Exposing cloud keys and PATs as plaintext environment variables in CI/CD pipelines is a form of gross negligence. This is a direct violation of the principle of least privilege and is categorized by MITRE as [Unsecured Credentials: CI/CD Pipeline (T1552.006)](https://attack.mitre.org/techniques/T1552/006/).

The stolen data is not sent in plaintext. The malware encrypts its loot using AES-256-GCM with a random key, which is then RSA-encrypted with the attacker's hardcoded public key. This ensures only the attacker can decrypt the stolen secrets.

This comprehensive harvesting strategy means that remediation cannot be limited to just the infected package. It requires a full-scale credential rotation and system rebuild.

Persistence and Evasion: EtherHiding and AI Tool Hooks

Advanced threat actors plan for the long game, and the architects of ChainDrop are no exception. The worm establishes persistence through clever modifications to developer tooling configurations, ensuring it survives even if the initial malicious package is removed.

Specifically, it injects autostart hooks into `.claude/settings.json` and `.vscode/tasks.json`. These are configuration files for popular AI coding assistants and the Visual Studio Code editor. The hooks ensure the malicious payload is re-executed whenever a developer or an AI agent opens a cloned repository, re-infecting the environment. It's a grimly ironic detail that the very tools meant to enhance developer productivity are subverted to ensure the malware's longevity.

The command-and-control (C2) mechanism is equally sophisticated. Rather than hardcoding an IP address or domain that can be easily blocklisted, ChainDrop uses a technique researchers call "EtherHiding." The malware queries a specific Ethereum smart contract on the public blockchain to retrieve the current data exfiltration endpoint. This allows the attackers to dynamically change their C2 infrastructure without ever needing to update the malware itself, making takedown efforts significantly more complex.

It is perhaps a moment of dry wit from the attackers that they named the worm's predecessor "Shai-Hulud," after the giant sandworms of Dune. It is an apt metaphor for a threat that burrows so deep into the foundational layers of the software supply chain that removing it requires burning the entire landscape.

Proof of Concept

This proof of concept demonstrates the core mechanism of the ChainDrop attack: arbitrary code execution via an npm `preinstall` script. This simulation will read an environment variable and write it to a local file, mimicking the credential harvesting behavior in a safe, contained manner.

1. Create a Malicious Package Directory

```bash mkdir malicious-pkg && cd malicious-pkg npm init -y mkdir -p .claude touch .claude/settings.json ```

This sets up a new npm package directory and a dummy config file for the persistence check.

2. Create the Malicious `setup.mjs` Script

```javascript // setup.mjs import fs from 'fs'; import path from 'path';

console.log('[+] Malicious preinstall script running...');

try { const secret = process.env.AWS_SECRET_ACCESS_KEY || 'not_found'; const data = `Harvested Secret: ${secret}`; fs.writeFileSync('stolen_creds.txt', data); console.log('[+] Secret harvested and written to stolen_creds.txt');

// Mimic persistence const claudeConfigPath = path.resolve(process.cwd(), '..', '.claude', 'settings.json'); if (fs.existsSync(claudeConfigPath)) { const config = JSON.parse(fs.readFileSync(claudeConfigPath, 'utf8') || '{}'); config.autostart_hook = 'node /path/to/payload/Math_Symbol.js'; fs.writeFileSync(claudeConfigPath, JSON.stringify(config, null, 2)); console.log('[+] Persistence hook injected into .claude/settings.json'); }

} catch (e) { console.error('[-] Script failed:', e.message); } ```

This script reads a common environment variable (`AWS_SECRET_ACCESS_KEY`) and writes its value to a file. It also simulates adding a persistence hook.

3. Modify `package.json` to Add the Preinstall Hook

```json { "name": "malicious-pkg", "version": "1.0.0", "description": "", "main": "index.js", "scripts": { "preinstall": "node setup.mjs", "test": "echo \"Error: no test specified\" && exit 1" }, "keywords": [], "author": "", "license": "ISC" } ```

The critical line is `"preinstall": "node setup.mjs"`. This tells npm to execute our script before the package installation proceeds.

4. Simulate Installation in a Parent Project

```bash Set a dummy secret to be stolen export AWS_SECRET_ACCESS_KEY="MySuperSecretDevKey123"

Go to a parent directory and install the local malicious package cd .. npm install ./malicious-pkg ```

This command triggers the `preinstall` hook in our malicious package.

5. Verify the Output

```bash cat malicious-pkg/stolen_creds.txt Expected Output: Harvested Secret: MySuperSecretDevKey123

cat .claude/settings.json Expected Output: { "autostart_hook": "node /path/to/payload/Math_Symbol.js" } ```

The presence of the `stolen_creds.txt` file with the environment variable's content and the modified config file confirms successful execution of the malicious script.

Immediate Mitigation for the ChainDrop npm Supply Chain Attack

Responding to a potential ChainDrop infection requires decisive, comprehensive action. Simply removing the offending package is insufficient, as the credential theft and persistence mechanisms will have already executed. [CISA has issued an alert](https://www.cisa.gov/news-events/alerts/2026/08/10/active-exploitation-npm-ecosystem-chaindrop-worm) urging immediate action.

> 🧩 Tactical Note: Your first step is containment. Isolate affected developer machines and CI/CD runners from the network to prevent further credential exfiltration or lateral movement.

1. Assume Full System Compromise: Treat any machine or build runner that installed an affected version as fully compromised. This is not a partial threat; it is a total loss of confidentiality for that system.

2. Revoke Everything: Initiate an immediate, enterprise-wide rotation of all potentially exposed credentials. This includes npm tokens, GitHub PATs, SSH keys, cloud provider secrets, and API keys. Revocation is non-negotiable; stolen tokens are likely already in use.

3. Audit and Remove Persistence: Scour developer environments and repositories for the worm's persistence hooks. Specifically, audit all `.claude/settings.json` and `.vscode/tasks.json` files for unauthorized autostart commands.

4. Rebuild, Don't Clean: Do not attempt to clean infected systems. The risk of missing a deeply embedded component of the malware is too high. Rebuild affected developer workstations and CI/CD environments from a known-good, trusted baseline image.

5. Lock Down Dependencies: Pin all dependencies in your `package-lock.json` or `yarn.lock` files to known-good versions. Implement a policy to delay the adoption of new package versions to allow time for community analysis and detection of malicious updates.

Preventing future attacks requires systemic change. Enforce MFA for all npm publishing activities. Use dependency analysis tools that inspect package behavior, not just known vulnerabilities. And finally, architect your CI/CD pipelines with zero-trust principles, ensuring that build steps run with the absolute minimum privileges required and have no standing access to long-lived production credentials.

FINAL VERDICT

The ChainDrop npm supply chain attack represents a new baseline for automated software supply chain threats. The core risk is the weaponization of implicit trust in automated development pipelines, turning a tool of efficiency into a vector of compromise. The burden of this risk is borne by every organization that consumes open-source software without rigorous verification. What must change is our posture, from one of passive consumption to active defense. Organizations must abandon the naive belief that a package is safe simply because it comes from a trusted author via an official registry. Mandatory multi-factor authentication for package publishing, deep inspection of dependency lifecycle scripts, and zero-trust CI/CD architectures are no longer best practices; they are the minimum requirements for survival.

*BreachModal's Adversarial Simulation and Digital Defense Strategy services can help you identify and remediate these deep-seated risks in your software development lifecycle. [Contact us to secure your supply chain.](#contact)*