ChainDrop Supply Chain Attack: Over 400 NPM Packages Compromised

Post Views: 89

More than 2,200 malicious versions of 440 distinct packages were uploaded to the NPM registry as part of a new supply chain attack campaign.

Overview of the Attack

Over 400 NPM Packages Compromised in ChainDrop Supply Chain Attack More than 2,200 malicious versions of 440 distinct packages were uploaded to the NPM registry as part of a new supply chain attack campaign. The operation, attributed to the Mini Shai-Hulud threat group, leveraged compromised maintainer accounts in the keyv and cacheable namespaces to deploy initial malware carriers. These malicious packages collectively received over 500 million weekly downloads, according to security researchers.

Threat Group and Attack Pattern

The attack follows a pattern seen in prior Mini Shai-Hulud campaigns, with infected packages executing malicious code during installation. The payload functions as an information stealer capable of self-replication. Once deployed, the malware scans infected systems for sensitive data, including credentials for NPM, GitHub, cloud services, and infrastructure platforms. It encrypts stolen secrets and transmits them to either a dynamic HTTPS endpoint or public GitHub repositories labeled with the “Shai-Hulud: Here We Go Again” description.

Microsoft detailed the malware’s ability to exploit recovered credentials to authenticate to NPM, GitHub, AWS, Kubernetes, and HashiCorp Vault. This enables the threat actor to access package repositories, CI/CD pipeline secrets, cloud configurations, and vault-stored credentials.

Malware Capabilities and Spread

The malware also uses compromised NPM credentials to republish altered versions of affected packages, while GitHub credentials and GitHub Actions are utilized to compromise additional repositories for further credential harvesting. The campaign’s scale escalated rapidly, with 2,212 malicious package versions detected within four hours on August 4. This surge was driven by the malware’s ability to regenerate historical versions of compromised packages.

Advanced Features and Evasion Techniques

A preinstall dropper embedded in all malicious versions initiates the attack chain. The malware, an advanced variant of the Shai-Hulud 2.0 worm, employs an Ethereum blockchain for command-and-control (C&C) communications, a method termed EtherHiding. It also includes a host-level dead-man’s switch: on macOS and Linux systems, it periodically checks the GitHub API using stolen tokens. If the token becomes invalid, the malware deletes its state and exits. Additionally, it self-erases after 24 hours to evade detection.

Recommendations for Affected Users

NPM developers who installed any affected packages are advised to treat their systems as compromised. Immediate steps include malware removal, rebuilding CI/CD environments, revoking and rotating credentials, and auditing GitHub repositories for suspicious activity. Security experts recommend preserving package tarballs, npm logs, CI logs, GitHub audit logs, and runner images to analyze the breach timeline.

Broader Implications and Mitigation

The attack highlights vulnerabilities in software supply chains, particularly the risks associated with compromised maintainer accounts and credential reuse. Researchers emphasize the importance of continuous monitoring and strict access controls for package registries and cloud platforms. The incident underscores the evolving tactics of threat actors leveraging blockchain infrastructure for C&C and the need for robust mitigation strategies in DevOps ecosystems.