ChainDrop Worm Bypasses Source Repositories to Poison npm Supply Chain

A sophisticated new variant of the Shai-Hulud npm worm, dubbed “ChainDrop” by Microsoft and other researchers, has compromised 444 packages, as The Register first reported. The attack targeted deep infrastructure dependencies, including cache-manager, flat-cache, and keyv, which collectively see approximately 2 billion monthly downloads.

ChainDrop employs stealthy propagation techniques that circumvent traditional open-source repository safeguards. Rather than relying on source commits, the worm propagates via tarballs. When executed, the malware searches for cloud keys, secrets, and npm tokens with full write privileges within environment variables, shell configurations, and live memory. Once an npm token is stolen, ChainDrop downloads the corresponding package tarballs, injects its own payload, and rebuilds them, leaving the original source code repositories appearing untampered.

Additionally, the worm targets GitHub credentials to commit malicious configuration code directly into repository branches. Abby Kearns, CEO of ActiveState, noted that simply opening an infected Git branch in Claude Code or VS Code can trigger background tasks that harvest credentials. This allows the worm to spread through automated CI/CD pipelines that pull patch updates during rebuilds.

Kearns noted that the attack identified a gap in the way dependency scanning tools were configured to monitor execution paths. To mitigate the threat, Kearns advised developers to inspect all branches for unauthorized .vscode/tasks.json and .claude/settings.json files and to treat repository-supplied configuration as executable content. While the infected packages have been removed from npm, the security firm SafeDep has provided a comprehensive list of compromised versions for auditing purposes.