“This is the first campaign to notice the gap and use it at scale. It will not be the last one,” wrote Abby Kearns, CEO of ActiveState, describing a novel npm supply-chain worm researchers have dubbed "ChainDrop."
How ChainDrop spreads: tarballs, not commits
Security researchers on August 4 identified a large-scale npm supply chain attack using a new variant of the Shai‑Hulud worm that infected 444 packages across multiple publishers. The compromised packages are collectively downloaded about 2 billion times a month, and the operation targeted deep infrastructure dependencies such as keyv, flat-cache and cache-manager.
Unlike typical supply-chain compromises that modify repository source commits, ChainDrop propagates by operating on package tarballs — the archived files users and CI systems download. When ChainDrop has access to an npm token with full write privileges, it downloads the tarballs for packages the token can modify, rebuilds those tarballs to include its payload, and republishes them. Because the change lives in the tarball rather than the repository source, reviewing commits in the source repository can show no evidence of tampering.
Credential harvesting and lateral movement
When executed, ChainDrop scans the user's workspace for credentials: npm tokens with full write privileges, cloud keys, secrets stored in shell configurations, environment variables and even secrets in live memory. Any harvested data is encrypted and sent back to attacker-controlled endpoints.
The worm also searches for GitHub credentials. If it finds them, ChainDrop uses the GitHub API to list accessible repositories and branches, then commits malicious configuration code directly into those branches. That second propagation path creates startup hooks in repository configuration files so that merely opening an infected Git branch in VS Code or Claude Code can trigger credential harvesting and continue the infection cycle.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildWhy standard defenses missed it
ActiveState’s Abby Kearns noted that ChainDrop does not rely on the “typical methods of breaching the defenses of open source repositories.” The campaign exploits execution paths that many dependency scanners and repository policies were not configured to inspect: repository-supplied configuration files and tarball contents that can be executed or loaded by development tools and CI/CD systems.
Kearns urged teams to “begin treating repository-supplied configuration as executable content, because that is what it is now,” and recommended reevaluating trusted publishing tools such as GitHub Actions. In short, the campaign uses mechanisms engineering teams adopted rapidly—configuration and automation—to create an execution path outside the scope of traditional package-source review.
What developers should look for and immediate remediation steps
All infected packages were quickly yanked from npm. Open source security firm SafeDep published a list of the compromised packages and affected versions; maintainers and users are advised to check that list against what they have installed.
- Inspect repository configuration files for unexpected additions—ActiveState specifically advised checking for .claude/settings.json and .vscode/tasks.json files you did not add yourself.
- Search not only the main branch but all branches for unexpected configuration commits or files.
- Rotate credentials that may have been exposed, and audit tokens with full write privileges.
- Evaluate trusted publishing and CI tools for whether they can be abused to introduce executable configuration during build or developer workflows.
What this means for developers, security teams, and enterprise procurement
- Developers and security teams: Expect to expand scanning and review to include repository-supplied configuration and to treat those files as executable attack surface; check branches and configuration files that open in development tools such as VS Code and Claude Code.
- Enterprise procurement and platform owners: Reevaluate which publishing and CI tooling (for example, GitHub Actions and similar automation) you trust implicitly during package publishing and rebuild workflows.
- Open-source maintainers and package consumers: Cross-check installed package versions against the SafeDep list of compromised releases and prefer supply-chain practices that limit token scope and write access.
The ChainDrop campaign shows a shift in attacker tradecraft: rather than forcing changes into a repository’s source history, the worm inserts itself into the artifacts and configuration developers and automated systems trust. That inversion leaves fewer obvious audit trails and requires defenders to treat configuration, tarballs and developer tool integrations as potential execution vectors. As Kearns warned, this is the first large campaign to exploit that gap—and according to the same source, it will not be the last.
Source: The Register — ChainDrop worm crawls into npm supply chain, evades standard defenses
