A recent supply chain attack, dubbed ‘ChainDrop,’ has compromised 444 npm packages, resulting in over 1,300 malicious releases. This campaign began with the takeover of the GitHub account associated with the Keyv caching library, affecting packages that collectively account for more than two billion monthly installations. The attackers exploited stolen npm publishing tokens and legitimate release channels to propagate the malware.
Unlike traditional attacks that rely on package installation, ChainDrop introduced malicious configurations into repositories. These configurations were designed to execute when developers opened projects in Visual Studio Code (VS Code) or initiated sessions in Claude Code. Consequently, merely cloning a repository and opening the project could expose developers to the malware, bypassing conventional supply chain security measures that monitor installation processes.
Microsoft has identified this campaign as ‘ChainDrop,’ while other researchers refer to it as ‘Mini Shai-Hulud,’ drawing parallels to previous similar attacks. The exact method by which the attackers initially compromised the maintainer’s account remains undisclosed. However, this incident underscores the potential for a single compromised account to exploit trusted publishing mechanisms, automated workflows, and developer tools as vectors for malware distribution.
The attack commenced on August 4, targeting the GitHub account responsible for Keyv and related packages such as cacheable, flat-cache, and file-entry-cache. By leveraging stolen credentials, the attackers published altered releases and subsequently harvested additional publishing access to broaden the infection. Projects that automatically track the latest major versions were particularly vulnerable, whereas those pinned to older major versions remained unaffected.
The malicious releases appeared legitimate due to valid provenance attestations. They were published through a GitHub Actions workflow configured as an npm trusted publisher, leading records to indicate that an approved identity performed the release. The critical issue was that malicious code had been introduced into the repository before the workflow execution, highlighting a vulnerability in the current trust model of the software supply chain.
For maintainers, addressing this breach required comprehensive measures: wiping affected machines, disabling GitHub Actions and trusted publishing, withdrawing compromised versions, removing malicious branches and tags, and resetting impacted branches. Teams are advised to revoke and rotate exposed credentials, review workflow permissions, and rebuild affected developer or continuous integration environments from a known-clean state.
ChainDrop also introduced configuration files into multiple repository branches, including a Claude Code SessionStart hook and a VS Code task set to run upon folder opening. These configurations could launch a dropper from the respective tool’s directory, enabling execution without an npm install or build. This tactic evades many dependency scanners, which typically focus on manifests and lockfiles rather than project settings that define editor tasks or AI coding-tool behavior.
To mitigate such risks, organizations should treat repository-supplied configurations as executable content and incorporate these paths into their review, monitoring, and incident-response protocols. Additionally, developers should exercise caution when marking projects as trusted in VS Code Workspace Trust and Claude Code, as doing so can increase exposure to such attacks.
This incident serves as a stark reminder of the evolving nature of supply chain attacks. It emphasizes the need for developers and organizations to adopt a holistic approach to security, scrutinizing not only code and dependencies but also the configurations and workflows that underpin the development process.
