What Unit 42 Found
Unit 42 says the self-propagating npm worm nicknamed ChainDrop infected more than 400 packages that are downloaded hundreds of millions of times a week, including malicious versions of keyv and cacheable-request. It detected ChainDrop running in 10 distinct environments and found 453 public GitHub repositories across five accounts that matched the worm’s exfiltration pattern.
An infected package keeps its legitimate code. The only changes are a preinstall hook and two extra files: setup.mjs, a dropper that downloads Bun 1.3.13 if needed, and math_init.js, a 727 KB obfuscated payload. The install finishes without errors while the payload runs in the background. On Russian-language hosts it exits.
Details Specific To This Analysis
- CI runner memory: an embedded Python helper reads the GitHub Actions
Runner.Workerprocess memory through/procto collect OIDC tokens and runner secrets that never touch disk. - Cross-linked persistence:
.vscode/tasks.jsonruns.claude/setup.mjswhen a folder opens, and.claude/settings.jsonadds a Claude Code SessionStart hook that runs.vscode/setup.mjs. Unit 42 says to remove all five dropped files. - Valid provenance: a dormant path aimed only at the opensearch-js release workflow would use npm trusted publishing and Sigstore to sign a modified package. Unit 42 notes that valid provenance only proves which workflow built a tarball, not that it is clean.
- Blockchain C2: the worm reads its C2 domains from an Ethereum contract. On August 4 the operator switched the active domain from
npm-cache[.]comtoawqhnjewqjkl[.]icuwith one transaction, without changing the deployed malware. - Leaked tokens: in one fallback the worm double-Base64-encodes a stolen GitHub token into a public commit message prefixed with
IfYouBlockThisAPIKeyItWillCrashTheLiveProductionServersOfAllThirdPartyClients, which other copies of the worm search for and reuse.
What To Verify First
- Search repositories for the
.claudeand.vscodefiles above, a.github/workflows/codeql_analysis.ymlcontainingtoJSON(secrets), andMath_Symbol.jsormath_init.js. - Search your commit history for the marker string above. A match is a leaked credential that must be revoked.
- Block
npm-cache[.]com,pypi-get[.]comandjs-mirror[.]comat DNS and SNI. Unit 42 recommends sinkholing because the worm treats HTTP 400 and 404 replies as a healthy C2. - Clear lockfiles, caches and CI images that pulled an infected version. Moving the npm
latesttag back to a clean release does not fix machines that already installed the bad one.
What Teams May Be Underestimating
Scope is wider than the published package list. Any package that a stolen npm token could publish may have received the worm, so enumerate everything the affected developer’s credentials can modify.
Know what matters before your first meeting.
Weekday mornings. Five minutes. What changed in security, why it matters.
By subscribing you agree to our Privacy Policy.
Free. Weekday mornings. 5 minutes or less.
Source Context
This item was rebuilt from the following primary sources and original reporting:
Related In The Daily Brief
See this item in The 5-Minute Cyber Brief
Newer CyberExperts coverage on this topic
This article still works as background. If you want the current picture, start with the freshest related coverage below and today's brief.
Coder’s registry infrastructure compromised to push malicious modules
The Coder incident is a supply-chain lesson in miniature: once attackers can tamper with trusted module distribution, defenders are no longer verifying...
Attackers Turn Trusted Node.js Runtime Into Malware Delivery Tool in Targeted Attacks
The useful lesson in this campaign is not that Node.js is bad. It is that adversaries keep choosing legitimate runtimes defenders already...
HPE patches critical ArubaOS-CX remote code execution flaw
ArubaOS-CX deserves attention because switching software rarely gets treated with the same urgency as identity or edge security until exploitation arrives. A...
Thursday’s brief: Cisco email gateways under attack, then PAN-OS, Nextcloud and AhsayCBS
The fastest way to catch up on what changed after this article was published.
Start your morning with the signal that matters.
Get the biggest cybersecurity developments, why they matter, and where to go deeper on CyberExperts.
By subscribing you agree to our Privacy Policy.
Free. Weekdays. Built for operators.
