Summary
- Microsoft identified malicious releases affecting more than 400 npm packages across unrelated publishers.
- The worm searches developer and CI environments for package, repository, cloud, Kubernetes, and secret-store credentials.
- Stolen npm publishing tokens allow it to modify and republish further packages automatically.
A self-propagating worm has compromised more than 400 packages in the npm software registry, using stolen publishing identities to turn ordinary dependency updates into a mechanism for extending the attack.
Microsoft Threat Intelligence said the campaign affected packages associated with several unrelated publishers and enterprise software ecosystems, including Keyv, flat-cache, and cache-manager. The malicious releases carried a Mini Shai-Hulud variant inside a large, heavily obfuscated JavaScript payload built to run with Bun.
The code commonly executes through an npm preinstall hook, meaning it can begin operating before installation of the requested package has completed. It searches developer workstations and continuous integration and delivery environments for credentials linked to npm, GitHub, cloud platforms, Kubernetes, and HashiCorp Vault.
Microsoft said the malware can use recovered identities to inspect packages, source-code repositories, workflow secrets, cloud parameters, and values held in secret stores. Collected information is encrypted and transmitted to an attacker-controlled HTTPS service, with GitHub repositories used as a fallback exfiltration route.
The defining capability is automated propagation. After obtaining a valid npm publishing token, the worm identifies packages the compromised account can release, downloads their latest archives, adds the malicious loader and preinstall hook, increments the patch version, and republishes the altered packages.
That process shifts the attack from a collection of poisoned packages into an identity-driven compromise of the publishing system. A single developer or automation account may have authority over several libraries, while organisational publishing credentials can reach packages used across many downstream projects.
The package count does not reveal the number of affected organisations. Some poisoned releases may never have been installed, while a widely used library can enter thousands of applications and build pipelines through direct or transitive dependencies. Automated dependency updates can also pull a malicious patch release into projects without a developer making a deliberate package-selection decision.
ChainDrop follows several recent attacks against development ecosystems, including campaigns that compromised legitimate publishing workflows or introduced malicious packages under names designed to resemble internal dependencies. Cyber Insider has also examined how npm compromises linked to a North Korean campaign moved through trusted development infrastructure rather than relying on conventional perimeter intrusion.
The self-propagating model increases the difficulty of containment. Removing identified malicious versions from the registry does not revoke credentials already taken from developer machines, build systems, cloud accounts, or secret stores. Nor does it establish whether attackers used those credentials outside the automated package-publishing sequence.
Organisations investigating exposure therefore face several separate questions: whether a poisoned package was downloaded, whether its install hook executed, which credentials were available to the process, whether those credentials were used, and whether any internally published software was subsequently modified.
The attack also exposes the concentration of trust inside build environments. Continuous integration systems routinely hold tokens that can publish packages, access repositories, retrieve cloud configuration, and deploy software. Those permissions support automation, but they allow a compromise that begins in one dependency to cross several administrative boundaries without exploiting an additional software vulnerability.
Microsoft has published indicators, detection information, and hunting guidance for the campaign. The company has not attributed ChainDrop to a named group, and the complete downstream exposure remains unknown. Differences between package inventories reported by researchers may also change as compromised releases are identified, removed, or reconstructed from registry data.
The immediate incident concerns npm, but the operational failure is wider: software publishers, source-code platforms, cloud services, and deployment pipelines are connected through reusable credentials. ChainDrop uses those connections to convert access to one environment into the authority needed to compromise the next.
