ChainDrop: Inside a Self-Propagating npm Worm

What Unit 42 Found

Unit 42 says the self-propagating npm worm nicknamed ChainDrop infected more than 400 packages that are downloaded hundreds of millions of times a week, including malicious versions of keyv and cacheable-request. It detected ChainDrop running in 10 distinct environments and found 453 public GitHub repositories across five accounts that matched the worm’s exfiltration pattern.

An infected package keeps its legitimate code. The only changes are a preinstall hook and two extra files: setup.mjs, a dropper that downloads Bun 1.3.13 if needed, and math_init.js, a 727 KB obfuscated payload. The install finishes without errors while the payload runs in the background. On Russian-language hosts it exits.

Details Specific To This Analysis

• CI runner memory: an embedded Python helper reads the GitHub Actions Runner.Worker process memory through /proc to collect OIDC tokens and runner secrets that never touch disk.
• Cross-linked persistence: .vscode/tasks.json runs .claude/setup.mjs when a folder opens, and .claude/settings.json adds a Claude Code SessionStart hook that runs .vscode/setup.mjs. Unit 42 says to remove all five dropped files.
• Valid provenance: a dormant path aimed only at the opensearch-js release workflow would use npm trusted publishing and Sigstore to sign a modified package. Unit 42 notes that valid provenance only proves which workflow built a tarball, not that it is clean.
• Blockchain C2: the worm reads its C2 domains from an Ethereum contract. On August 4 the operator switched the active domain from npm-cache[.]com to awqhnjewqjkl[.]icu with one transaction, without changing the deployed malware.
• Leaked tokens: in one fallback the worm double-Base64-encodes a stolen GitHub token into a public commit message prefixed with IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients, which other copies of the worm search for and reuse.

What To Verify First

• Search repositories for the .claude and .vscode files above, a .github/workflows/codeql_analysis.yml containing toJSON(secrets), and Math_Symbol.js or math_init.js.
• Search your commit history for the marker string above. A match is a leaked credential that must be revoked.
• Block npm-cache[.]com, pypi-get[.]com and js-mirror[.]com at DNS and SNI. Unit 42 recommends sinkholing because the worm treats HTTP 400 and 404 replies as a healthy C2.
• Clear lockfiles, caches and CI images that pulled an infected version. Moving the npm latest tag back to a clean release does not fix machines that already installed the bad one.

What Teams May Be Underestimating

Scope is wider than the published package list. Any package that a stolen npm token could publish may have received the worm, so enumerate everything the affected developer’s credentials can modify.

Source Context

This item was rebuilt from the following primary sources and original reporting:

• Unit 42: ChainDrop: Inside a Self-Propagating npm Worm

Related In The Daily Brief

See this item in The 5-Minute Cyber Brief

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].

Keep Reading

Explore more →

Lazarus hackers exploited Windows zero-day to target defense firms

North Korean hackers have been exploiting CVE-2026-68820, a Windows AFD.sys privilege-escalation flaw, to target defense-sector firms as part of Operation…

The 5-Minute Cyber Brief: September 3, 2026

CISA adds ownCloud, Linux kernel and Artifactory flaws to KEV, new SonicWall SMA 1000 zero-days, Sangoma Switchvox exploited, All-in-One WP…

#StopRansomware: Gunra Ransomware

CISA's Gunra advisory is useful because it gives defenders more than a ransomware name. It maps how the group gets…