A Sizable Supply Chain Attack Hits NPM, Exposing 500 Million Weekly Downloads to Malicious Code
In a massive supply chain attack dubbed “ChainDrop,” over 440 NPM packages have been infected with malware, compromising more than 2,200 package versions and exposing hundreds of millions of users to potential cyber threats. This attack is a prime example of the ongoing risks associated with software supply chains and highlights the importance of vigilance in the development community.
The campaign began when an attacker compromised the GitHub account of a maintainer for two key packages: “keyv” and “cacheable.” From there, 11 malware carriers were distributed to unsuspecting developers through NPM. The infected packages were then used to spread the malware further, compromising an additional 433 packages in the process. This chain reaction led to over 2,200 malicious package versions being published to the NPM registry, with a staggering 500 million weekly downloads.
The malware itself is designed to execute malicious code during installation, stealing sensitive information such as secrets and credentials from developer workstations and continuous integration and delivery (CI/CD) environments. Once executed, the malware uses recovered identities to authenticate to various services, including NPM, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault. This allows it to enumerate packages, repositories, workflow secrets, cloud parameters, and secret-store values.
The malware also republishes poisoned versions of every package it can reach on the infected machine, leveraging compromised credentials to infect more repositories for credential theft. Furthermore, it injects configuration files into GitHub repositories, establishing persistence and creating an additional developer-to-developer infection path.
What’s particularly noteworthy about this attack is its use of an Ethereum blockchain for command-and-control (C&C), a technique called EtherHiding. This allows the malware to communicate with its operators in a secure and decentralized manner. Additionally, the worm installs a host-level dead-man’s switch: after achieving persistence on macOS and Linux, it polls the GitHub API every 60 seconds using the victim’s stolen GitHub token, deleting its state and exiting if the token stops working.
Developers who installed any of the infected package versions should consider their machines compromised. They are advised to remove the malware, rebuild CI runners and build machines, revoke and rotate potentially compromised credentials, and audit their GitHub repositories for anomalous activity. As JFrog recommends, affected systems should be isolated, and logs preserved before cleanup.
This attack serves as a stark reminder of the importance of supply chain security in software development. It’s essential for developers to remain vigilant and take proactive measures to protect themselves against similar threats. By doing so, they can help prevent the spread of malware and ensure the integrity of their projects.
Source: SecurityWeek — 2026-08-05