CHAINDROP Worm Compromises Over 1,300 NPM Packages

Executive Summary

A widespread and automated software supply chain attack, dubbed CHAINDROP, was identified on August 4, 2026. This self-propagating worm, a variant of the Shai-Hulud malware family, compromised the maintainer account for the popular keyv npm package. It then used these credentials to inject malicious code into over 1,300 dependent packages, affecting projects with a combined total of over two billion monthly downloads. The malware is designed to steal developer credentials for services like npm, GitHub, and AWS, as well as cryptocurrency wallets and AI configuration files. The Cyber Security Agency of Singapore (CSA) has issued an advisory, urging organizations to review their dependencies and treat credentials on affected systems as compromised.

Threat Overview

The attack began with the compromise of the maintainer account for keyv, a key-value storage library with over 600 million monthly downloads. The threat actors published a malicious version of keyv containing the CHAINDROP worm. The worm's design is insidious; it automatically identifies all other packages the compromised maintainer has access to and publishes backdoored versions of them. This created a cascading effect, rapidly spreading the malware through the npm ecosystem.

Key affected packages include:

• keyv (version 6.0.0)
• flat-cache (version 6.1.24)
• cacheable-request
• file-entry-cache (version 11.1.6)

Researchers at Elastic, who first identified the campaign, noted its rapid propagation. The malware is cross-platform, targeting Linux, macOS, and Windows systems, maximizing its potential victim pool within the developer community.

Technical Analysis

The attack vector relies on a legitimate npm feature: the preinstall script in the package.json file. This hook allows commands to be executed automatically before a package is installed, requiring no user interaction beyond running npm install.

1. Initial Infection: The attacker publishes a malicious version of a popular package (keyv).
2. Execution: When a developer installs the malicious package, the preinstall script executes a dropper, often disguised with names like Math_Symbol.js or math_init.js.
3. Data Exfiltration: The payload scours the compromised system for sensitive data, including credentials from .npmrc, .git-credentials, and AWS configuration files. It also targets cryptocurrency wallet files and AI-related API keys.
4. Propagation: The worm uses the stolen npm credentials to publish malicious versions of other packages maintained by the compromised developer, continuing the cycle.

Commits generated by the worm can be identified by the author name claude and the commit message chore: update config. This pattern suggests an automated process.

MITRE ATT&CK Mapping

• T1195.002 - Compromise Software Supply Chain: The core of the attack involves injecting malicious code into a legitimate software package ecosystem.
• T1059.007 - JavaScript: The payload is executed via JavaScript within the preinstall hook.
• T1555.003 - Credentials from Web Browsers: The malware steals credentials stored in configuration files, which is analogous to this technique's intent.
• T1552.006 - Stored Cloud Credentials: The payload specifically targets AWS credentials.

Impact Assessment

The business impact of the CHAINDROP attack is severe. Organizations that rely on the affected packages are at immediate risk of credential theft, leading to potential breaches of their internal systems, cloud infrastructure, and source code repositories. The theft of developer credentials can facilitate deeper intrusions, lateral movement, and further supply chain attacks. The cost of remediation, including identifying all compromised systems, revoking and rotating all potentially stolen credentials, and auditing codebases, is substantial. The attack also erodes trust in the open-source ecosystem, forcing development teams to allocate more resources to dependency vetting and security.

IOCs — Directly from Articles

Cyber Observables — Hunting Hints

Security teams may want to hunt for the following patterns to identify potential compromises related to this campaign:

Detection & Response

1. Dependency Scanning: Use tools like npm audit or third-party Software Composition Analysis (SCA) solutions to identify vulnerable versions of keyv and other affected packages in all applications.
2. Log Analysis: In CI/CD environments and on developer machines, search for process execution logs related to preinstall scripts that invoke suspicious files like Math_Symbol.js.
3. Credential Rotation: Assume any credentials (npm, GitHub, AWS, etc.) on systems that have installed the malicious packages are compromised. Immediately revoke and rotate all potentially affected keys, tokens, and passwords.
4. Network Monitoring: Monitor for and investigate anomalous outbound traffic from developer workstations and build servers, especially to destinations not on an allowlist. This aligns with D3-NTA: Network Traffic Analysis.

Mitigation

1. Dependency Pinning: Use lockfiles (package-lock.json, yarn.lock) to ensure that builds use exact, vetted versions of dependencies. This prevents the automatic installation of newly published malicious versions. This is a form of D3-ACH: Application Configuration Hardening.
2. Vetting and Controls: Implement stricter controls around adding new dependencies. Use private npm registries to host vetted versions of open-source packages.
3. Least Privilege for CI/CD: Ensure that CI/CD pipelines and build agents have only the minimum necessary permissions. Avoid storing long-lived, powerful credentials in these environments. Use short-lived tokens where possible.
4. Developer Training: Educate developers on the risks of supply chain attacks and the importance of scrutinizing dependencies and their associated scripts. This aligns with MITRE Mitigation M1017: User Training.