Cybersecurity Threat Unfolds as ChainDrop Malware Infects 1,300 npm Packages
In a shocking display of supply-chain attacks, over 1,300 packages on the Node Package Manager (npm) registry have been compromised by self-propagating malware named ‘ChainDrop’. This attack has already spread to hundreds of popular applications, including caching utilities from the same maintainer. The scale and sophistication of this threat make it a major concern for developers and security teams worldwide.
The attack started after a threat actor compromised the GitHub account of Keyv’s maintainer, allowing them to push malicious files directly to projects’ main branches and generate new package releases. Because these packages were built and published through legitimate GitHub Actions workflows, the compromised npm releases carried valid provenance information. This made it difficult for users to detect the malicious content.
The ChainDrop malware contains two primary components: a payload dropper called setup.mjs and an infostealing script named Math_Symbol.js. When executed, these files collect sensitive information from the compromised environment, including developer credentials, cloud tokens, and even database passwords. The stolen data is then encrypted and sent to a public GitHub repository with the ominous description “Shai-Hulud: Here We Go Again”.
The malware’s ability to spread quickly across npm packages has left many developers and security teams scrambling to contain the damage. According to Aikido researchers, at least 868 packages across 1,381 versions have been compromised by the worm. This attack is a prime example of why dependency allowlisting, integrity checks, and provenance controls are crucial in modern software development.
As the situation continues to unfold, cloud security company Wiz has discovered that the ‘npm-cache[.]com’ domain is being used for exfiltrating data. System administrators should treat developer workstations or CI/CD runners as compromised if an affected package version was installed, even if the package was subsequently removed. In such cases, it’s recommended to rebuild systems from safe backups or from scratch and rotate all tokens that were accessible from the impacted environment.
Security companies Aikido, Wiz, StepSecurity, Socket, and Ox Security have made lists of compromised npm packages and indicators of compromise available online. These resources can help developers and security teams identify affected applications and take necessary precautions to prevent further spread of the malware.
In conclusion, this attack highlights the risks associated with supply-chain attacks in modern software development. To mitigate these risks, it’s essential for developers to implement robust dependency management strategies, regularly update packages, and monitor their codebases for suspicious activity. By taking proactive measures, we can reduce the likelihood of such attacks and minimize the damage when they occur.
Source: Bleeping Computer — 2026-08-04