A recent attack has compromised over 444 npm packages, affecting more than a dozen publishers and resulting in an astounding 2 billion monthly downloads collectively. This malware infiltrated the npm registry following the breach of Jared Wray’s GitHub account, known for maintaining Keyv, a highly popular package boasting over 150 million weekly downloads. The malicious version 6.0.0, published on a Tuesday morning at around 9:00 UTC, introduced Shai-Hulud credential-stealing malware.
The compromised GitHub account was linked to several other widely-used packages, such as cacheable, flat-cache, file-entry-cache, and cache-manager, with tainted versions being released shortly after the initial incident. The propagation didn’t stop there, as several npm packages from other organizations—like @deliveroo/reevent and @picsart/ai-sdk—also reported infections. The security firm StepSecurity confirmed the malicious presence across 444 packages and 2,212 versions by 18:10 UTC.
These compromised versions all share a common infection pattern, featuring a preinstall dropper that fetches the legitimate Bun JavaScript runtime along with a 710KB obfuscated second stage. This second stage is designed to steal credentials, disseminate further malicious packages, and delve into AI developer tools, as noted by researchers from StepSecurity.
Branded as ChainDrop, this attack marks a new phase in the ongoing issue with Shai-Hulud, well-known in the past year for exploiting supply chains on npm and PyPI repositories. The name ChainDrop stems from this new variant employing Ethereum blockchain for its command and control methods, a strategy known as EtherHiding.
Wray confirmed via X that he utilized OpenID Connect (OIDC) and one-time codes for GitHub, avoiding long-term static tokens. He regained control of his account around 20:00 UTC and mentioned he would conduct a comprehensive audit of his security settings.
AI Development Tools Targeted
The malicious payload comprises files like setup.mjs and Math_Symbol.js, which can also appear as math_init.js in some instances. These files run during the npm installation process through a preinstall script, initiating a download and execution of a secondary obfuscated payload on the compromised device.
This malware has been engineered to seek out cloud credentials, infrastructure secrets, developer access tokens, and configuration files related to AI, along with cryptocurrency wallets. It extends its reach into CI/CD workflows as well, attempting to extract temporary secrets from build runners during the development process.
What makes this variant particularly concerning is its capability to embed persistent mechanisms within code editors like VS Code using tasks.json and into AI development companions like Claude Code through defined hooks.
According to researchers from Wiz, the targets for credential theft have broadened significantly, now encompassing AI-agent credential stores like those for Claude, OpenAI, and Codex, as well as cryptocurrency keystores for Foundry and Solana. Other targets include cloud CLI configurations and system files, raising the stakes for affected developers.
Recommended Measures
For enterprise security teams, the need to conduct full audits of developer machines is paramount. Any infected versions of the packages could have introduced vulnerabilities to any systems that installed them during the attack timeframe, possibly exposing credentials on that device and connected machines.
Security experts recommend rotating essential credentials immediately, including npm automation tokens, GitHub personal access tokens, as well as SSH keys and cloud provider credentials. The StepSecurity researchers emphasized that maintainers should treat their publish credentials as potentially compromised, given that the malware was uploaded by additional maintainer accounts almost simultaneously.
The report by StepSecurity also includes indicators of compromise, a catalog of the infected packages, and comprehensive defensive strategies that could assist in preventing further incidents. Employing the --ignore-scripts npm flag in CI workflows can help mitigate risks by bypassing the malicious preinstall script. Additionally, newer package managers support policies for minimum release ages, providing a crucial buffer against recently compromised versions.
As security agencies continue to scrutinize the npm registry, new supply chain compromises are regularly uncovered within hours. Although the npm team removed the tainted versions swiftly, this worm's self-propagating nature poses ongoing challenges, as it can continue to expand through newly compromised developer accounts.
