ChainDrop Worm: Sophisticated npm Supply Chain Attack Leveraging GitHub Actions and Trusted Publishing
The ChainDrop worm is a self-propagating supply-chain attack that has compromised 444 npm packages, affecting ecosystems with over 2 billion monthly downloads. By compromising high-reputation GitHub accounts, attackers inject malicious code into main branches to trigger automated releases via GitHub Actions. Critically, the use of OpenID Connect (OIDC) through "Trusted Publishing" allows the poisoned packages to arrive with valid provenance and digital signatures, neutralizing traditional integrity checks. The malware employs a multi-stage execution pattern, utilizing the Bun JavaScript runtime to deploy a 710KB obfuscated payload. It utilizes "EtherHiding"—a Command and Control (C2) mechanism leveraging the Ethereum blockchain—to evade network-based detection while targeting cloud credentials, AI-agent configurations, and cryptocurrency keystores.
Chai: Agentic Discovery of Cryptographic Misuse Vulnerabilities
Chai is an AI-driven research framework designed to detect high-impact semantic vulnerabilities in cryptographic implementations. Unlike traditional tools focused on memory safety via instrumentation, Chai utilizes an "inverted discovery model" through an AI-enhanced differential testing engine. By identifying behavioral discrepancies in foundational libraries—specifically within X.509, JWT, and SAML implementations—and propagating these findings via a Cryptographic Dependency Graph (CDG), Chai identifies systemic logic flaws. The framework has surfaced over 100 vulnerabilities, including a critical zero-day in a major SSL library affecting billions of devices across Linux distributions and web browser components.