A self-propagating npm worm nicknamed ChainDrop infected "over 400 packages that are collectively downloaded hundreds of millions of times each week," Unit 42 reports — and it uses those trusted dependencies to reach developer workstations, CI runners, cloud instances and downstream users.
How ChainDrop spreads and hides inside legitimate packages
Unit 42 analyzed infected packages that included intact SDK source, dependencies and documentation — plus just two extra top-level files and a single lifecycle hook. The only manifest change in many samples is a preinstall command that points to a dropper (setup.mjs). That dropper uses the legitimate Bun 1.3.13 runtime as an execution vehicle, then feeds Bun a 727 KB obfuscated payload (math_init.js).
The worm preserves package functionality: original code is left in place, a patch version is incremented, and the compromised package is republished. It also plants CI artifacts (a .github/workflows/codeql_analysis.yml that serializes ${{{{ toJSON(secrets) }}}}) and creates public repositories under victim accounts — described in the report as bearing the description "Shai-Hulud: Here We Go Again" with Dune-themed names.
What ChainDrop steals and the exfiltration channels it uses
Once running, the worm harvests a wide range of material: cloud credentials from metadata and token endpoints, npm and GitHub tokens, SSH keys, Terraform state, Vault tokens, Kubernetes kubeconfigs and service-account tokens, AI-tool credentials and developer artifacts such as .env and .netrc files. It also reads GitHub Actions runner memory — opening /proc/<pid>/maps and /proc/<pid>/mem to extract OIDC tokens and runner secrets — capturing ephemeral credentials that might never touch disk.
Stolen data is JSON-serialized, gzipped, encrypted with a random AES-256-GCM key and wrapped with RSA-OAEP-SHA256 using an embedded public key, then sent to an operator-controlled router endpoint at hxxps://npm-cache[.]com:443/router over TLS. If the domain-based channel fails, the worm falls back to searching attacker-signed or victim-owned GitHub commits for backup domains or to exfiltrate via victim repositories.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleEthereum-based command-and-control and rapid domain rotation
Rather than a hard-coded host, ChainDrop resolves its C2 domains through an Ethereum smart contract at 0xE1f2395ee43e45A1556EC6438a88c31B83493103. The operator initially wrote three domains into the contract (npm-cache[.]com, pypi-get[.]com, js-mirror[.]com) after domain registrations on May 22, 2026 and funding via FixedFloat. Two hours and 35 minutes later the list was narrowed to npm-cache[.]com.
Late on Aug. 4, 2026 the operator executed transaction 0xc55920f1bd0531b6738153068a666c080ddded47e6256f1fd980d51c0b507c91 from wallet 0x55F9780ef31cD to rotate the active C2 domain to awqhnjewqjkl[.]icu. That domain was registered via NameSilo at 15:15:26 UTC on Aug. 4, 2026 and saw the earliest observed connection by Unit 42 at 16:10:03 UTC. Both old and new domains were proxied through Cloudflare and served the same Cloudflare CDN stylesheet, illustrating how a single on-chain write can silently reconfigure an otherwise static malware footprint.
Persistence, stealth checks and a weaponized supply-chain provenance
ChainDrop plants persistence in developer tooling: cross-linked VS Code and Claude Code artifacts (.vscode/tasks.json and .claude/settings.json) that execute the dropper when a project is opened or when a Claude Code session starts. The worm includes latent OS-level installers (macOS LaunchAgent and a Linux systemd user service) that were present but not invoked in the analyzed sample.
It also implements a repository-gated path that abuses GitHub Actions OIDC to mint legitimate npm publish credentials and produces valid Sigstore/Fulcio provenance for modified tarballs — meaning signatures can attest that an infected tarball was built in the signed workflow. Unit 42 warns that valid provenance does not equal safety if the workflow itself runs attacker code.
What this means for developers, CI operators and security teams
- Developers and maintainers: search for and remove modified package versions, check for .vscode/.claude persistence artifacts and inspect recent patch releases for unexpected preinstall hooks, setup.mjs, math_init.js or large minified bundles.
- CI operators and cloud teams: treat runners as potentially compromised if ChainDrop executed; rotate npm, GitHub, cloud, SSH and automation credentials; and audit runners for memory-scraping activity and leaked commit markers (thebeautifulmarchoftime and the long marker IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients).
- Security teams and incident responders: monitor the resolver contract for future setStrings() calls, block the domains and the Ethereum eth_call traffic to 0xE1f2395ee43e45A1556EC6438a88c31B83493103, and search for the file and artifact indicators Unit 42 lists.
Unit 42 detected ChainDrop across 10 environments and identified 453 public repositories (across five accounts) matching exfiltration markers; the researchers emphasize that lockfiles, caches and CI images can retain poisoned artifacts even after package tags are corrected. Their practical remediation checklist — from revoking tokens to removing persistence and blocking both domain- and GitHub-based exfiltration — is actionable and immediate.
ChainDrop shows a new synthesis: reuse of published toolkits, Ethereum-based C2 agility, live-memory credential theft and provenance abuse. The attack both leverages and warps standard developer convenience: preinstall hooks, CI OIDC and trusted provenance. How defenders respond — particularly around runner hygiene, token rotation and proactive repository scans — will determine how widely this worm can be contained.
