ChainDrop npm worm steals dev credentials, self-propagates
The preinstall-hook payload executes before tests or security gates run, turning one compromised npm token into hundreds of poisoned packages across unrelated publishers, and there's no reliable count yet of infections that fired before disclosure.
TL;DR
Microsoft disclosed a self-propagating npm supply-chain worm (ChainDrop) that has infected more than 400 packages across unrelated publishers, including keyv, flat-cache, and cache-manager. The Mini Shai-Hulud variant uses an npm preinstall hook to execute before any test or CI/CD security gate, stealing GitHub, AWS, Kubernetes, npm, and HashiCorp Vault credentials from developer workstations and build runners. The malware republishes compromised packages automatically using stolen tokens. Development teams that pulled affected versions face credential rotation from clean environments and full dependency-chain triage.
Microsoft's disclosure of ChainDrop lands in a npm ecosystem that's been absorbing supply-chain body blows for two years, and this one raises the stakes by automating what used to require an attentive human adversary.
The worm uses a preinstall lifecycle hook to drop a heavily obfuscated Bun-based JavaScript payload before npm install completes. That timing matters: preinstall fires before tests, before linters, before any security scanning that assumes the package is still a passive artifact. On developer workstations, the payload detaches itself and continues running after installation finishes. In CI/CD, it stays attached to harvest workflow secrets, OIDC tokens, and runner credentials.
Once it has credentials, the worm doesn't just exfiltrate, it authenticates to GitHub, AWS, Kubernetes, and HashiCorp Vault, enumerates what the compromised identity can access, and scoops up additional secrets. Then it moves to propagation: enumerate publishable npm packages, download the latest tarball, insert the malware, bump the patch version, and republish. One stolen token becomes dozens of new compromised packages, each capable of repeating the cycle.
The preinstall problem is structural, not incidental
npm's lifecycle hooks have been the delivery mechanism for this entire wave: the Red Hat Miasma campaign in June 2026, the Mastra compromise that same month, and now ChainDrop. The common pattern (preinstall scripts that execute before anyone inspects the package) isn't a bug. It's the design. And the industry's stock mitigation, --ignore-scripts, doesn't help when the malicious code runs at import time instead of install time, as Microsoft documented in the AsyncAPI compromise last month.
ChainDrop also introduces GitHub as a persistence and fallback channel. The worm injects Claude and VS Code configuration files into repositories, and when its primary HTTPS exfiltration endpoint is unavailable, it creates a public GitHub repository with collected results. That's two separate abuse vectors on a platform most development teams treat as trusted infrastructure.
What the disclosure doesn't answer
Microsoft hasn't said whether npm has revoked publishing tokens for all 400-plus affected packages, or what the timeline looks like for detecting infections that executed before the takedown. The worm's fallback exfiltration to GitHub repositories (including a repository named Shai-Hulud) predates this specific campaign; CISA's September 2025 alert described identical behavior. That means the infrastructure for credential dumping on GitHub has been live and public for nearly a year.
For defense contractors subject to CMMC and NIST SP 800-171, the operational question is stark. If a developer workstation in your supply chain pulled a compromised package, the attacker may hold credentials to your source repositories, your cloud infrastructure, or your CI/CD pipelines. Rotating credentials from a known-clean environment isn't a weekend exercise, it's a full incident-response workflow. And for primes that consume open-source dependencies from subcontractors, the blast radius extends across organizational boundaries that most compliance frameworks don't track.
Microsoft's guidance (audit dependency trees, rotate credentials, enable phishing-resistant MFA, pin versions to known-safe releases) is sound. But the gap between "audit your dependencies" and "know whether a worm executed in your pipeline three weeks ago" is wide, and ChainDrop is built to exploit exactly that gap.
Published ·Deep Fathom