Critical npm Supply Chain Attack CHAINDROP Backdoors 400+ Packages

Key Takeaways

• A new self-propagating malware, CHAINDROP, has compromised over 400 npm packages, impacting more than 1.3 billion monthly downloads.
• The attack leverages a compromised maintainer account for the widely used `keyv` library, inserting malicious preinstall hooks into `package.json`.
• CHAINDROP steals developer credentials, including npm, GitHub, and cloud tokens, then uses them to republish infected packages and spread further.
• The malware utilizes an Ethereum smart contract for dynamic command-and-control (C2) server lookup, enhancing its resilience.
• Organizations should implement soak periods for new package versions, enforce 2FA, and immediately revoke credentials on affected systems.

The npm ecosystem is once again grappling with a sophisticated supply chain attack, as a new self-propagating malware dubbed CHAINDROP has backdoored over 400 packages. This campaign, identified by Elastic Security Labs on August 4, 2024, represents a significant escalation, exploiting compromised maintainer credentials to spread malicious code across a vast network of developer tools and applications.

The incident began with the compromise of the maintainer account for the popular keyv library, a crucial component for many JavaScript projects. This breach allowed attackers to inject the CHAINDROP malware, which then leveraged normal software update mechanisms to propagate, impacting packages with a staggering 1.3 billion monthly downloads. This widespread compromise places developers, build systems, and downstream applications at severe risk.

As Elastic said in a report, this event underscores how a single compromised maintainer account can trigger an ecosystem-wide security crisis. The attack echoes the earlier Shai-Hulud npm supply-chain incident, where stolen publishing credentials were used to distribute malware through legitimate release channels, highlighting a persistent vulnerability in software supply chains.

Shai-Hulud CHAINDROP Worm Backdoors 400+ npm Packages

The CHAINDROP attack initiates through a preinstall hook embedded within the package.json file, a standard npm feature that executes commands before a package completes its installation. This means that merely installing or updating an affected dependency can trigger the malicious code, without requiring developers to explicitly open or import it. The stealthy nature of this execution, often overlooked during routine code reviews of patch updates, allows the malware to run undetected within developer workstations and automated build environments.

Every subpackage within the compromised keyv monorepo was found to contain a dropper. This dropper, identified as setup.mjs, was designed to launch the main payload across Linux, macOS, and Windows operating systems. The malicious releases utilized related components in both directly compromised packages and those affected by the worm’s propagation, providing distinct indicators for defenders to trace suspicious activity.

Once active, CHAINDROP systematically harvests credentials from developer systems. It targets a wide array of sensitive data, including npm tokens, GitHub access tokens, cloud service credentials, Kubernetes secrets, SSH keys, CI/CD pipeline access, and tokens for AI coding tools. The malware specifically seeks npm tokens that grant write access to packages and, critically, permit publishing without two-factor authentication. Upon acquiring such a token, CHAINDROP retrieves packages, injects its malicious files, increments version numbers, and then republishes the compromised packages, perpetuating the supply chain infection.

Beyond npm, the malware also exploits captured GitHub App tokens to alter repositories. It injects malicious Claude Code and VS Code configuration files across up to 50 repository branches. This tactic creates an additional execution vector, as merely opening an infected repository can activate the malware. The interconnected risk between repository access and registry access, as demonstrated by the Keyv package compromise details underscore this critical connection.

Credential Theft and Containment

The CHAINDROP payload is engineered to locate and exfiltrate over 300 distinct credential patterns. It compresses and encrypts this sensitive data before transmitting it to attacker-controlled infrastructure. A notable feature of the malware is its use of an Ethereum smart contract (0xE1f2395ee43e45A1556EC6438a88c31B83493103) to dynamically resolve its command-and-control (C2) destination. This innovative technique allows the threat actor to modify their C2 infrastructure without needing to republish the malware, making it more resilient to detection and takedown efforts.

To mitigate the risk of such attacks, organizations are strongly advised to implement a “soak period” for new package versions, delaying their adoption in production builds. This delay provides critical time for security researchers and maintainers to identify and address poisoned releases, a strategy proven effective in past incidents like the poisoned Axios package. Elastic also provided a comprehensive list of Indicators of Compromise (IoCs) to help organizations identify and contain potential infections.

What You Should Do

• Implement a Soak Period: Delay the adoption of new npm package versions in production or critical build environments. This allows time for security researchers and the community to identify and report any malicious updates.
• Revoke and Regenerate Credentials: Immediately revoke all GitHub tokens and regenerate npm access tokens on any system that may have installed affected versions of the keyv library or its subpackages. Pay particular attention to automation tokens that might bypass two-factor authentication (2FA).
• Rotate Secrets: Rotate all cloud, Kubernetes, Vault, AI-tool, and CI/CD secrets that could have been present on impacted endpoints.
• Enable 2FA for npm: Ensure two-factor authentication is enabled for all npm accounts, especially for maintainers. Review and remove bypass_2fa capabilities where they are not strictly necessary.
• Upgrade npm: Upgrade to npm version 12 or later, which blocks preinstall hooks by default. This provides a crucial defense against malicious preinstall scripts, a common vector in recent supply-chain attacks.
• Monitor and Audit: Use the provided Indicators of Compromise (IoCs) to check build logs for suspicious node or bun processes. Any confirmed hit should be treated as a full credential compromise, not just a bad dependency.
• Incident Response: Isolate affected endpoints, review all recent package publishing activity, replace all exposed secrets, and thoroughly audit all recent releases for unauthorized changes before resuming normal development operations.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.