npm Ecosystem / Supply Chain — ChainDrop: Self-Propagating npm Worm with Ethereum C2 Resolution (N/A)

Publication date: August 6, 2026
Category: Supply Chain Attacks / Malware Analysis

Introduction

On August 6, 2026, researchers at Unit 42 (Palo Alto Networks) disclosed the discovery of ChainDrop, a sophisticated self-propagating worm targeting the Node Package Manager (npm) ecosystem. This malware successfully infected over 400 legitimate packages—including high-download dependencies such as keyv and cacheable-request—accumulating hundreds of millions of weekly downloads. The threat compromises developer workstations, continuous integration (CI) environments, cloud infrastructure, and downstream users by harvesting authentication credentials, SSH keys, GitHub/npm tokens, and extracting secrets directly from GitHub Actions runner memory to autonomously republish malicious versions while preserving legitimate functionality.

What is ChainDrop? (General Analysis)

ChainDrop operates far beyond a standard static downloader trojan; it functions as a modular, highly resilient supply chain worm. Its primary objective is credential harvesting and automated propagation using stolen publishing tokens from compromised developer accounts or repositories.

By abusing package lifecycle scripts, leveraging portable execution runtimes (such as Bun), and utilizing Ethereum smart contracts for decentralized Command and Control (C2) infrastructure management, ChainDrop represents a significant escalation in open-source software supply chain threats.

  • CWE Classification (Reasoned Estimation):
    • CWE-506: Embedded Malicious Code.
    • CWE-829: Inclusion of Functionality from Untrusted Control Sphere.
  • CVSS v3.1 Score (Reasoned Estimation): 9.8 (Critical)
  • CVSS v3.1 Vector (Reasoned Estimation): CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

How Does It Work? (Technical Analysis)

The infection chain and operational mechanics of ChainDrop stand out due to their multi-stage complexity:

  • Initial Flow and Infection: The malicious package includes legitimate SDK source code alongside two extra top-level files and a preinstall lifecycle hook in its package.json. This command points to setup.mjs, a script verifying whether the Bun JavaScript runtime is available on the PATH. If absent, it downloads Bun 1.3.13 from the official Oven GitHub repository, utilizing a legitimate runtime as a portable execution vehicle. It then feeds Bun a 727 KB obfuscated JavaScript payload (math_init.js) compressed into two source lines.
  • Environmental Filters and Evasion: Before collection begins, the worm checks whether it runs inside a CI environment (running inline with chatty debug output) or locally (detaching into a background process with _NODE_RUNTIME_INIT=1). Additionally, it incorporates a locale check that exits cleanly if a Russian-language host is detected.
  • Massive Credential Harvesting: The background payload sweeps the infected machine to harvest cloud infrastructure credentials (querying metadata endpoints for IAM roles), developer tooling (Docker, Helm, Git, PyPI, RubyGems, Terraform, Vault, SSH keys), AI-assisted coding tools, and configuration files (.env, shell histories, cryptocurrency wallets).
  • CI Memory Scraping: Utilizing an embedded encrypted Python helper, the worm targets the Runner.Worker process on GitHub Actions runners, opening /proc/<pid>/maps and /proc/<pid>/mem to search live process memory for OpenID Connect (OIDC) tokens and runner secrets before they expire or write to disk.
  • Cross-Linked Persistence and AI Tools: ChainDrop establishes persistence by writing a .vscode/tasks.json file (executing setup tasks upon opening the project in VS Code) and a .claude/settings.json file (with a session-start hook for Claude Code). Each file invokes the dropper copy residing in the other directory, masking the artifacts as legitimate tool configurations.
  • Blockchain-Based C2 and DGA: The worm lacks a hardcoded static C2 domain; instead, it issues Ethereum JSON-RPC calls (eth_call) to a smart contract (StringListStore at 0xE1f2395ee43e45A1556EC6438a88c31B83493103) to dynamically retrieve active exfiltration domains. It also supports fallback mechanisms via GitHub commit searches and algorithmically generated domains such as awqhnjewqjkl[.]icu.

Affected Systems / Environments

  • Software Ecosystem: npm registry packages (including widely used dependencies like keyv and cacheable-request, alongside compromised third-party packages).
  • Development Environments: Developer workstations running Node.js and Bun, environments configured with Visual Studio Code and Claude Code.
  • CI/CD Pipelines: Self-hosted or cloud-managed GitHub Actions runners.
  • Cloud Platforms & DevOps: Environments storing AWS, GCP, Azure credentials, Docker, Kubernetes service-account tokens, kubeconfigs, Terraform state, and secrets managers like HashiCorp Vault.

Mitigation and Detection

Remediation

  1. Identification and Removal: Locate and completely remove affected npm package versions across projects. Clear poisoned lockfiles (package-lock.json, yarn.lock, etc.), caches, mirrors, and local tarballs.
  2. Comprehensive Credential Rotation: Immediately revoke and rotate npm tokens, GitHub Personal Access Tokens (PATs), deployment keys, cloud IAM credentials, Vault tokens, SSH keys, and automation secrets accessible from confirmed or potentially infected hosts.
  3. Persistence Cleanup: Scan for and remove associated malicious files including .vscode/tasks.json, .claude/settings.json, .claude/math_init.js, math_init.js, setup.mjs, and orphaned monitoring scripts.
  4. Network Egress Filtering: Apply strict egress firewall policies on CI/CD runners to block outbound communication to unauthorized C2 endpoints, allowing traffic exclusively to private registries and verified deployment targets.

Detection

  • Behavioral and Process Monitoring: Leverage behavioral threat detection tools (such as Cortex XDR) to identify the execution of the Bun runtime invoking malicious scripts inside node module caches or executing GitHub CLI commands like gh auth token.

Defensive Intelligence Note: The detection of modified dependencies featuring preinstall hooks invoking alternative runtimes, or commits in public repositories containing distinctive long exfiltration strings (such as IfYouBlockThisAPIKeyItWillCrash...), serves as definitive evidence of active supply chain compromise.

kql 
// Detection of Chaindrop worm payload execution via the bun runtime
dataset = xdr_data
| filter event_type = ENUM.PROCESS
| filter action_process_image_name in ("bun", "bun.exe") 
  and (action_process_image_command_line contains "Math_Symbol.js" or action_process_image_command_line contains "math_init.js")
| fields agent_hostname, agent_id, causality_actor_process_command_line, actor_process_image_name, action_process_image_command_line

Wrapping Up

The ChainDrop incident underscores how open-source infrastructure and modern development tooling (including AI coding assistants like Claude Code and advanced IDEs) can be weaponized by threat actors to achieve silent persistence and efficient self-propagation. By abusing legitimate publishing mechanisms, blockchain smart contracts for resilient C2 rotation, and advanced process memory scraping in CI environments, the worm redefines risks associated with software dependency management. To counter this threat, organizations must adopt workload-bound credential architectures, utilize ephemeral CI runners, and enforce rigorous scrutiny over lifecycle scripts within their software supply chains.

References