A newly discovered npm supply-chain malware called ChainDrop is infecting packages with stolen developer credentials, turning it into an automated system that spreads across multiple systems. The malware has reportedly affected over 400 npm packages, including popular projects like keyv and cacheable-request, compromising developers, CI/CD pipelines, cloud environments, and downstream users. Unlike typical malicious packages that target a single victim, ChainDrop is designed to spread through stolen credentials from various sources such as publishing tokens, GitHub tokens, cloud credentials, SSH keys, Docker settings, Kubernetes tokens, Terraform state files, and environment secrets.
Persistence is achieved through cross-linked techniques (Source: unit42).
A worm script (Source: Unit 42) targets GitHub Actions runners by identifying the Runner.Worker process and accessing memory regions containing OpenID Connect tokens, runner secrets, and other temporary credentials. Researchers discovered dormant code for macOS LaunchAgent and Linux systemd user services, but these operating-system persistence paths were not observed in the main execution chain, according to Unit 42. Indicators of Compromise Type: IOC (Indicator of Compromise) SHA-256 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc MathSymbol.js / mathinit.js payload SHA-256 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668 First setup.mjs variant SHA-256 fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb Second setup.mjs variant SHA-256 b27b82afa5f15512f3856e549fb83d873fd0049759a4b62ce64c8d7d4dc2c678
