ChainDrop: The self-propagating worm that infects 400 npm packages and steals cloud credentials

A self-propagating worm infects over 400 npm packages: the ChainDrop threat

A recent cyberattack saw the spread of a self-propagating worm called ChainDrop, which infected over 400 npm packages downloaded hundreds of millions of times every week. Among the compromised packages are malicious versions of widely used packages such as keyv and cacheable-request.

The impact of ChainDrop

The attackers behind ChainDrop potentially exposed developer workstations, continuous integration (CI) pipelines, cloud environments, and end-users of software in numerous organizations. Once installed, ChainDrop steals:

Cloud credentials

npm and GitHub tokens

SSH keys

Other sensitive developer data

The worm is capable of extracting temporary credentials from the memory of GitHub Actions runners and using stolen npm publishing tokens to infect and republish further packages, keeping their legitimate functionality intact.

Discoveries during the investigation

During the investigation of this attack, 453 public GitHub repositories on five accounts were identified that matched the worm's exfiltration patterns. Additionally, ChainDrop executions were detected in 10 distinct environments. At the time of publication, these repositories have been removed.

Malware features

The malware was deobfuscated and several features were identified:

Persistence through development tools and AI

Blockchain-based command and control (C2) resolution

Ability to execute additional code provided by the attackers

Furthermore, on August 4, 2026, the entire C2 infrastructure of the worm was silently reconfigured through a single Ethereum transaction, without requiring any changes to the distributed malware.

Security recommendations

Unit 42 recommends:

Identifying installations of the affected npm package versions

Investigating developer workstations and CI runners for signs of compromise

Examining unexpected npm publishing activity and GitHub repositories

Revoking and rotating npm, GitHub, cloud, SSH, and automation credentials potentially exposed

Removing identified persistence mechanisms

Blocking both domain-based and GitHub-based exfiltration channels

Detection and prevention tools

The Koi Agentic Endpoint Security risk engine reported the activity of the malicious package as the attack unfolded. Cortex XDR detected and reported the worm's execution using predefined behavioral detections. Palo Alto Networks customers can use Koi Agentic Endpoint Security to help identify and control malicious packages on developer endpoints.

Additional tools and services

Cortex AgentiX Threat Intel agent: helps analysts extract, enrich, and search IoCs using natural language to quickly determine organizational impact.

Cortex Cloud Endpoint Protection: leverages AI-enabled analytics to help detect and prevent threats targeting Linux endpoints, containers, and associated cloud IAM policies.

Cortex XDR and XSIAM: provide behavioral detection, investigation, and response that can help organizations address ChainDrop activity running in development environments.

Idira Secrets Manager and Secrets Hub: eliminate permanently hard-coded credentials from configuration files and source code by automating zero-downtime rotation and providing just-in-time access to non-human identities in multi-cloud and DevOps environments.

Unit 42 Cloud Security Assessment: is an assessment service that examines cloud infrastructure to identify misconfigurations and security gaps.

Unit 42 Incident Response team: can be engaged to help in case of compromise or to provide a proactive assessment to reduce risk.

Attack chain analysis

We analyzed the contents of one of the infected packages to understand the worm's behavior. The package included a malicious script that executed when the package was installed. This script performed several actions:

Downloaded and executed additional payloads from a remote server

Modified existing files in the project to maintain persistence

Collected and exfiltrated sensitive data from the developer's environment

The worm also attempted to spread to other projects by injecting malicious code into commonly used development tools such as package managers and build systems.

Persistence mechanisms

The worm employed several persistence mechanisms to ensure it could survive reboots and remain active on infected systems:

Cross-persistence through VS Code and Claude Code

A latent capability for operating system-level persistence

It wrote a .vscode/tasks.json file with a task labeled as Environment Setup and set it to run when the folder was opened, meaning it would automatically execute every time a developer opened the project in VS Code. That task executed node .claude/setup.mjs, a copy of the dropper that was byte-identical to the setup.mjs provided in the package itself. It also wrote a .claude/settings.json file with a SessionStart command hook, meaning it would execute every time Claude Code started a session in the project. That hook executed node .vscode/setup.mjs, a second copy of the same dropper.