Massive ChainDrop Supply-Chain Attack Spreads Malware to Hundreds of npm Packages
In a devastating blow to cybersecurity, a self-propagating malware named ‘ChainDrop’ has compromised over 1,300 packages on the Node Package Manager (npm) registry, affecting hundreds of millions of users. The attack began when a threat actor compromised the GitHub account of a popular package maintainer, spreading rapidly to other associated projects and organizations.
The malicious code, known as ChainDrop, uses a worm named Shai-Hulud to infect packages, deploying two files: setup.mjs, a payload dropper, and Math_Symbol.js, an infostealing script. The attack’s sophistication lies in its ability to generate new package releases with valid provenance information, making it difficult for users to distinguish between legitimate and compromised versions.
According to researchers at Aikido, the attacker pushed malicious files directly to projects’ main branches, using their legitimate GitHub Actions workflows to publish infected npm releases. This allowed the poisoned packages to contain a “preinstall” script that executed automatically before installation completed, installing the setup.mjs dropper and subsequently downloading the Math_Symbol.js script.
The malware’s ultimate goal is to collect sensitive information from compromised environments, including developer credentials, cloud tokens, and database passwords. It achieves this by searching infected systems for configuration files, GitHub PATs, workflow tokens, and other types of data. The stolen information is then encrypted and sent to a public GitHub repository with the description “Shai-Hulud: Here We Go Again.”
The attack’s impact extends beyond compromised packages, as researchers warn that any system administrators who installed an affected package version should treat their developer workstation or CI/CD runner as compromised, even if the package was subsequently removed. In such cases, rebuilding systems from safe backups or from scratch is recommended.
As the situation continues to unfold, security companies are urging users to remain vigilant and take proactive measures to protect themselves. Dependency allowlisting, integrity checks, and provenance controls can help mitigate the risk of supply-chain attacks like ChainDrop. A list of compromised npm packages and indicators of compromise (IoCs) is available from multiple sources, including Wiz, StepSecurity, Aikido, Socket, and Ox Security.
To stay safe, system administrators should regularly review their dependencies, monitor logs for suspicious activity, and be cautious when installing new packages. The use of dependency allowlisting can help prevent the installation of malicious packages, while integrity checks can detect anomalies in code behavior. By staying informed and taking proactive steps, users can minimize the risk of falling victim to supply-chain attacks like ChainDrop.
Ultimately, this attack serves as a stark reminder of the importance of cybersecurity vigilance in the software development lifecycle. As the npm registry continues to grow, so does the potential for supply-chain attacks. Users must remain aware of these risks and take steps to protect themselves from malicious actors seeking to exploit vulnerabilities in popular packages.
Source: Bleeping Computer — 2026-08-04