A new variant of the Shai-Hulud malware, known as CHAINDROP, has infiltrated the npm ecosystem, compromising over 400 packages. This attack began with the compromise of the maintainer account for the widely used ‘keyv’ library, leading to the insertion of malicious code into numerous packages, collectively accounting for more than 1.3 billion monthly downloads.
The CHAINDROP worm employs a preinstall hook within the ‘package.json’ file, a standard npm feature that executes commands before the completion of a package installation. This mechanism allows the malware to activate during the installation or update of an affected package, potentially without the developer’s awareness. Consequently, the malicious code can execute within developer workstations and build environments, posing significant security risks.
Once activated, CHAINDROP collects a wide array of credentials from the infected system, including npm tokens, GitHub credentials, cloud service keys, Kubernetes configurations, SSH keys, CI/CD pipeline secrets, and credentials from AI coding tools. The malware specifically targets npm tokens with package write access and the ability to publish without two-factor authentication. Upon obtaining such tokens, it retrieves the associated packages, injects its malicious code, increments the version numbers, and republishes them, thereby propagating the infection.
In addition to modifying npm packages, CHAINDROP can alter GitHub repositories when it captures GitHub App tokens. It adds malicious configuration files for tools like Claude Code and Visual Studio Code across multiple branches. This means that simply opening an infected repository can trigger the execution of the malicious code, further spreading the malware.
To evade detection and maintain control, the malware searches for over 300 credential patterns, compresses and encrypts the collected data, and sends it to attacker-controlled infrastructure. Notably, it determines its command-and-control server through an Ethereum smart contract, allowing the attackers to change their infrastructure without needing to republish the malware.
Organizations are advised to implement a delay before adopting new package versions, allowing time for potential threats to be identified. Machines that have installed affected versions should be thoroughly investigated, and any exposed credentials, including GitHub tokens and npm tokens, should be revoked and regenerated. Additionally, cloud service keys, Kubernetes configurations, and other sensitive secrets present on impacted systems should be rotated to mitigate potential risks.
Maintainers are encouraged to enable two-factor authentication on their npm accounts, remove the ‘bypass_2fa’ capability where it is not essential, and conduct regular reviews of their repositories to detect unauthorized changes. These proactive measures are crucial in safeguarding the integrity of the npm ecosystem and preventing further exploitation by malware like CHAINDROP.
The emergence of CHAINDROP underscores the evolving nature of supply chain attacks and the importance of robust security practices within the software development community. As attackers continue to refine their methods, developers and organizations must remain vigilant, implementing comprehensive security measures to protect against such sophisticated threats.
