Microsoft has uncovered a large npm supply-chain attack, called ChainDrop, that has poisoned more
than 400 software packages used by developers worldwide. The malicious code is a self-spreading
worm: when a developer or build system installs an affected package, it runs automatically, steals npm,
GitHub, and cloud credentials, then uses those credentials to poison and republish still more packages.
Any team that installed an affected package should treat that workstation or build server as
compromised and rotate its credentials from a clean machine at once.
1. Campaign Timeline
Microsoft Threat Intelligence tracked a rapid wave of unauthorised patch releases across more than 400 npm packages from otherwise unrelated publishers, including keyv, flat-cache, and cache-manager. Many malicious versions had no matching source commit, pull request, or tag, showing the attackers modified and republished package tarballs directly.
The payload is a Mini Shai-Hulud variant, a self-propagating credential worm built as a large, obfuscated Bun JavaScript bundle. Initial access points to stolen maintainer credentials, with later spread driven by stolen npm tokens and GitHub Actions OIDC publishing.
2. Attack Details
Delivery
Attackers publish trojanised patch versions of legitimate npm packages, each adding a preinstall lifecycle script that launches a bundled setup.mjs loader. Because npm runs preinstall scripts before installation finishes, the worm executes before tests or security checks begin.
Environment check
On launch the payload checks its environment, exits on Russian-language systems, avoids duplicate instances, and detaches into the background on developer workstations while staying attached inside CI jobs to reach build secrets.
Credential theft
It harvests credentials from local files, shell histories, environment variables, SSH keys, and GitHub Actions
runner memory, then authenticates to npm, GitHub, AWS, Kubernetes, and HashiCorp Vault to pull further secrets.
Exfiltration
Collected data is gzip-compressed and encrypted with AES-256-GCM under an attacker RSA key, then sent to an HTTPS endpoint whose domain is resolved through a blockchain contract, with public GitHub repositories as a fallback channel.
3. Payload Capabilities
The Mini Shai-Hulud payload is built to spread on its own and to survive beyond the first infected package:
- Self-propagation (worm): With a stolen npm token that has publish rights and 2FA bypass, the worm downloads each package the identity can publish, inserts itself and a preinstall hook, bumps the patch version, and republishes, turning one token into many poisoned releases.
- CI/CD and OIDC: abuse Inside GitHub Actions, it targets workflows configured as npm trusted publishers and republishes through OIDC, so malicious packages carry valid provenance and appear legitimate.
- Developer-to-developer: persistence Using stolen GitHub credentials, it injects loader files into .claude and .vscode configuration paths (.claude/settings.json, .vscode/tasks.json, and matching setup.mjs files), so later Claude or Visual Studio Code activity restarts the payload.
- Destructive handler: A conditional fallback installs a token-monitor component that keeps credential access and triggers a destructive handler if the monitored token is revoked.
4. Adversary Toolkit
| Tool / Indicator | Type | Function |
| setup.mjs | JavaScript (npm preinstall loader) | Bundled preinstall loader that launches the obfuscated Bun payload from the trojanised package. |
| Mini Shai-Hulud payload | Bun-based JavaScript worm | Obfuscated credential-stealing worm that harvests secrets, exfiltrates them, and republishes packages to spread. |
| token-monitor | JavaScript persistence component | Maintains credential access and runs a destructive handler if the monitored token is revoked. |
5. Indicators of Compromise (IOCs)
TYPE – INDICATOR
SHA256 – 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668
SHA256 – fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb
SHA256 – 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc
DOMAIN – npm-cache[.]com
DOMAIN – pypi-get[.]com
DOMAIN – js-mirror[.]com
URL – hxxps[:]//npm-cache[.]com:443/router
6. Recommendations
- Review dependency trees, lockfiles, artifact repositories, and CI caches, including transitive references, for the compromised package versions, and pin known-good versions.
- Treat any workstation or build runner that installed an affected package as compromised, purge npm and yarn caches, and rebuild affected systems and shared build images from trusted, known-good sources.
- From a clean host, revoke and rotate every credential the affected identity could reach, npm and GitHub tokens, AWS, Kubernetes, and HashiCorp Vault secrets, and check for unauthorised npm releases and repository or workflow changes.
- Update the npm CLI to v11.10.0 or later, enable the min-release-age setting, and harden GitHub Actions OIDC publishing: token scopes, workflow approvals, protected environments, and release provenance.
- Block the IOCs at their respective controls.
7. Sources
- https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise
anatomy-self-propagating-worm/ - https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-secu
rity-now-generally-available/
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.