A massive attack on packages in the NPM repository has been detected, using a new self-propagating ChainDrop worm that substitutes malware as dependencies. The attack resulted in 2,212 malicious releases published for 444 packages. The most popular of the compromised packages keyv, flat-cache and file-entry-cache accounted for 154, 149.9 and 147.6 million downloads per week.
The worm loader was located in the setup.mjs and Math_Symbol.js files, which were launched using the preinstall handler (“preinstall”: “node setup.mjs”) called when installing an affected package. These scripts downloaded the legitimate Bun runtime and obfuscated worm code, 710 KB in size. After activation, the worm searched the system and environment variables for tokens to NPM, PyPI, CircleCI, AWS, GCP, Docker, Azure, HashiCorp, KubernetesK8s and other services (in total, more than 140 file paths were analyzed, such as ~/.npmrc), and also analyzed the memory (via /proc//mem) of the GitHub Actions environment for tokens and credentials data.
If a token for connecting to the NPM directory was detected, the worm automatically published new malicious releases for packages being developed in the current environment, affecting the dependency tree. Unlike the previously identified Shai-Hulud 2.0 worm, ChainDrop implemented the EtherHiding technique to receive control commands through the public Ethereum blockchain, used encryption to hide confidential data transmitted to the attacking server, and ensured the introduction of Claude Code, VS Code and GitHub Copilot into the configuration files to consolidate its presence in the system.
The attack began with a compromise of the process of generating releases based on GitHub Actions for package keyv with 154 million downloads per week and used as a dependency in 1,703 packages. The attackers created a new version 6.0.0, inserting malicious code into it, and published it using the “Trusted Publishers” mechanism and correct SLSA certification. After publication, the worm infected many keyv-dependent packages and began to attack indirect dependencies along the chain.
Among the most popular packages that were affected by the worm, which published malicious releases for them:
- flat-cache 6.1.24 (149.8 million downloads per week);
- file-entry-cache 11.1.6 (147.5 million);
- cacheable-request