ChainDrop Worm: Sophisticated npm Supply Chain Attack Leveraging GitHub Actions and Trusted Publishing

The ChainDrop worm is a self-propagating supply-chain attack that has compromised 444 npm packages, affecting ecosystems with over 2 billion monthly downloads. By compromising high-reputation GitHub accounts, attackers inject malicious code into main branches to trigger automated releases via GitHub Actions. Critically, the use of OpenID Connect (OIDC) through "Trusted Publishing" allows the poisoned packages to arrive with valid provenance and digital signatures, neutralizing traditional integrity checks. The malware employs a multi-stage execution pattern, utilizing the Bun JavaScript runtime to deploy a 710KB obfuscated payload. It utilizes "EtherHiding"—a Command and Control (C2) mechanism leveraging the Ethereum blockchain—to evade network-based detection while targeting cloud credentials, AI-agent configurations, and cryptocurrency keystores.

• Incident Overview and Scope

  • Compromised 444 unique npm packages and 2,212 specific versions.
  • Impacts critical developer infrastructure with a combined monthly download volume exceeding 2 billion.
  • Represents a 70% increase in credential theft breadth compared to previous Shai-Hulud malware variants.

• Attack Vector and Execution Mechanics

  • Leverages compromised GitHub maintainer accounts to inject code directly into main branches.
  • Exploits GitHub Actions and OIDC-based "Trusted Publishing" to bypass provenance and integrity checks.
  • Employs an npm preinstall script to fetch the Bun JavaScript runtime.
  • Deploys a 710KB obfuscated secondary payload via setup.mjs, Math_Symbol.js, and math_init.js.

• Advanced Evasion and C2 Infrastructure

  • Utilizes "EtherHiding" to facilitate Command and Control (C2) via the Ethereum blockchain.
  • Employs blockchain-based communication to evade standard network monitoring and egress filtering.
  • Designed to blend into legitimate decentralized web traffic, complicating signature-based detection.

• Targeted Data and Persistence Mechanisms

  • Targets cloud provider CLI configurations (AWS, GCP) and CI/CD secrets (Jenkins, Argo CD, Harbor).
  • Targets modern AI-agent credentials (Claude, OpenAI, Gemini, Cursor) and developer IDE settings via VS Code tasks.
  • Attempts persistence through Claude Code hooks and local system files, including /etc/shadow and SSH keys.
  • Actively pursues cryptocurrency keystores including Foundry, Solana, and Monero.

• Detection and Mitigation Strategies

  • Monitor for unauthorized commits to main branches and unexpected GitHub Action execution triggers.
  • Audit package.json for suspicious preinstall scripts and unauthorized runtime dependencies like Bun.
  • Implement strict branch protection rules and audit OIDC-based publishing permissions.
  • Rotate all cloud, AI-agent, and CI/CD credentials immediately upon detection of suspicious activity.