ChainDrop: Self-Propagating npm Worm Harvesting Developer and CI Credentials

Unit 42 analyzed a self-propagating npm worm, tracked as ChainDrop, that infected more than 400 packages downloaded hundreds of millions of times weekly. Infection begins when a developer or build system installs a compromised version, whose manifest carries a preinstall lifecycle hook running an attacker-added setup script before any application code executes. The script downloads the Bun JavaScript runtime if absent, then uses it to run an obfuscated payload. The worm exits without collecting on hosts set to the Russian language, and follows a narrower path inside continuous integration jobs.

Credential collection targets material granting further access to software supply chains rather than end-user data. The payload harvests cloud provider credentials, npm and GitHub tokens, SSH private keys, and developer tooling configuration, and queries instance and container metadata endpoints for temporary IAM role credentials. On GitHub Actions runners it also uses an embedded Python helper to locate the runner worker process and read its live memory through the process filesystem, recovering identity tokens and runner secrets never written to disk. Collected data is compressed and encrypted before transmission to the command and control server.

Persistence relies on developer tooling configuration rather than operating system autostart mechanisms. The worm writes an editor task definition and an AI coding assistant configuration, each set to execute a dropper in the other tool's directory, so removing one restores it from the other. Installers for a macOS launch agent and a Linux systemd user service are embedded as well. Propagation uses stolen npm tokens: the worm reconstructs each package a token can publish, adds its own hook and payload files, increments the patch version, and republishes while preserving original functionality.

A separate path targets one specific repository, requesting an identity token from the runner, exchanging it at the registry's trusted publishing endpoint, and adding a typosquatted dependency pointing at a pinned attacker commit. It then obtains a signing certificate, builds a provenance statement over the package archive, and uploads the signed record to a public transparency log. Valid provenance therefore establishes only that a package was built by a given workflow, not that it is free of malicious code. Command and control resolution is held in an Ethereum smart contract read at runtime, letting operators rotate infrastructure by blockchain transaction. Exfiltration also targets public repositories, with 453 identified across five accounts.