More than 430 npm packages, accounting for a combined two billion monthly installs, were compromised in a credential-stealing campaign that began on August 4, security researchers report.
ChainDrop’s scale and notable targets
Security firm Aikido Security identified the campaign as “ChainDrop,” saying it has already affected over 430 packages with a combined two billion monthly installs. The intrusion began on August 4 when attackers compromised the GitHub account of a maintainer for the keyv key storage library, which Aikido says has “around 127 million weekly npm downloads.”
Researchers named specific npm packages that were injected with malicious code: cacheable (29 million downloads/month), flat-cache (565 million downloads/month), and file-entry-cache (557 million downloads/month). Aikido and other analysts reported that packages associated with Deliveroo, Ornikar, OneReach, Picsart and Qlik were also compromised as part of the campaign.
How ChainDrop spreads through trusted workflows
Aikido’s analysis describes a straightforward but effective infection chain: attackers used the hijacked GitHub account to push malicious files directly to the main branch of targeted repositories and then “immediately cut a new release.” As Aikido explained, “the poisoned versions were published to npm with valid provenance signed by GitHub Actions.”
That valid provenance is central to ChainDrop’s worm-like propagation. Once developer credentials are stolen, the malicious code can use those credentials to publish further poisoned releases and to access other repositories and packages tied to the affected tokens.
Nobody's watching your logs at 2 AM.
Full SOC coverage without building one. Nubivance deploys and manages Rapid7 InsightIDR and MDR for organizations that need detection and response, not another dashboard.
Get coverage →What the malware steals and where it sends it
The injected code acts as an infostealer. According to the published analysis, the malicious packages are designed to harvest:
- npm and GitHub tokens
- AWS credentials
- Kubernetes secrets
- HashiCorp Vault tokens
- Stripe and Slack tokens
- Generic file system contents via a scan
Once collected, the stolen artifacts are encrypted and exfiltrated to a public GitHub repository whose description reads “Shai-Hulud: Here We Go Again.” Analysts note ChainDrop follows the pattern of earlier Shai-Hulud campaigns, using credential theft to move through trusted publishing workflows and compromise additional maintainers and repositories.
What this means for open-source maintainers, CI/CD teams at affected companies, and security teams
Open-source maintainers: The immediate risk is account takeover and unauthorized pushes to main. Maintainers who use single-factor or otherwise exposed credentials may find poisoned releases published under their projects.
CI/CD and build teams at affected companies: Because poisoned releases in npm can be pulled automatically into builds, teams must assume that installing or building with affected versions could introduce stolen tokens into attacker control. Companies with packages connected to Deliveroo, Ornikar, OneReach, Picsart and Qlik have already been named among those impacted.
Security teams and incident responders: The campaign’s combination of token theft and automated publication creates a need to hunt for related indicators, rotate exposed secrets, and treat build and CI/CD systems as potentially compromised if they pulled infected packages.
Mitigation guidance from Microsoft and Wiz
Microsoft and Wiz Security published analysis and indicators of compromise (IOCs) alongside mitigation advice. Wiz’s recommendations, as reported, include:
- Identify and remove affected package versions from development, build, and CI/CD environments
- Treat affected systems as potentially compromised and rebuild them if malicious packages were installed
- Rotate exposed credentials (eg cloud credentials, GitHub tokens, SSH keys, Kubernetes configurations, Terraform credentials)
- Review cloud and source-code environments for unauthorized access or suspicious activity following package installation
- Monitor for published IOCs, including the relevant domains, file artifacts, and other indicators
- Build resilience by enabling dependency allowlisting, package integrity verification, and provenance controls where available
Semgrep’s ethical hacker and staff security advocate Katie-Paxton Fear emphasized the attack model’s familiarity: “The worm steals developer credentials, uses them to compromise more packages and keeps moving through trusted publishing workflows,” she said. She added that organizations “can’t assume that if they aren't using the package that they are safe. They need to treat any installation, even if they aren't using it, as a possible credential breach, and rotate exposed secrets, check logs for unauthorized access and audit their own packages for infection.”
ChainDrop is a reminder that compromises at the level of maintainer accounts and CI provenance can cascade rapidly through widely used ecosystems. Analysts and vendors have already published IOCs and step-by-step mitigation advice; for teams that rely on npm packages, the immediate actions are clear—identify and remove affected versions, assume compromise where those versions were present, and rotate credentials that could have been captured.
