ChainDrop: Self-Propagating npm Supply Chain Worm Targeting Developer Credentials Threat Campaign
Indicators of Compromise
Campaign Guidance
Remediation, mitigation, notes, history and related intelligence
Detection strategies sourced from MITRE ATT&CK v19.1 (attack.mitre.org/detectionstrategies/) and Microsoft Security Blog (04.08.2026). OTX AlienVault: no ChainDrop-specific pulse found at time of publication (campaign too recent).
Source | Technique | Detection / Remediation Guidance |
|---|---|---|
MITRE ATT&CK v19.1 official: A package manager (npm/yarn/pnpm) downloads or restores content, writes executable or script files into project paths (node_modules), and the first execution of newly written components triggers lifecycle hooks (preinstall/postinstall) or loader scripts, followed by network egress to non-approved registries or CDNs. | ||
MITRE ATT&CK v19.1 official: Developer or CI invokes npm/yarn/pnpm, which writes executable or script files into PATH or project directories and immediately executes embedded lifecycle hooks (preinstall/postinstall) that spawn shells or curl/wget, followed by egress to unfamiliar registries or domains. For ChainDrop: alert on node setup.mjs followed by bun binary download from /tmp/bun-dl-*/. | ||
MITRE ATT&CK v19.1 official (macOS): Developer tools install or update dependencies; new Mach-O or scripts appear under ~/Library, project directories (node_modules/.bin). First run spawns sh/zsh/osascript/curl and new outbound flows; Gatekeeper/AMFI may flag unsigned components. | ||
Monitor for user account authentication behavior anomalies. Alert on npm publish events originating from unexpected geolocations, times, or IP ranges. Monitor GitHub repository push events and release creation for packages that lack corresponding pull requests, commits, or tags - a pattern characteristic of tarball-level injection used in ChainDrop. | ||
MITRE: Preemptively search for files containing passwords and take actions to reduce exposure. For ChainDrop detection: monitor for mass concurrent file reads across .env, .npmrc, ~/.aws/credentials, ~/.ssh, Terraform state files, and Docker registry configs - the infostealer runs ~200 glob patterns with up to 64 concurrent reads. | ||
Monitor DNS queries and outbound HTTPS traffic from developer workstations and CI/CD runners. Alert on eth_call requests to Ethereum RPC endpoints (eth-mainnet.nodereal.io, go.getblock.io, eth.llamarpc.com) specifically referencing contract 0xE1f2395ee43e45A1556EC6438a88c31B83493103 selector 0x53ed5143. Dynamic C2 domain retrieval via blockchain is a key differentiator of ChainDrop. | ||
Monitor endpoint telemetry for processes performing high-frequency, broad-pattern file reads across multiple sensitive directories in a short time window. Alert on Node.js or Bun processes accessing credential files such as .npmrc, AWS credentials, SSH keys, Kubernetes configs, and vault tokens within the same session. | ||
Monitor network traffic for HTTPS connections to npm-cache.com:443/router and unexpected GitHub API calls creating new repositories with the description "Shai-Hulud: Here We Go Again". Alert on encrypted data uploads (results-<timestamp>-<counter>.json) to public GitHub repositories from developer or CI environments. | ||
Monitor for modifications to .claude/settings.json and .vscode/tasks.json, particularly commits authored as [email protected] with message "chore: update config". Alert on git push events that add or modify these files in branches not matching the repository's normal release workflow. | ||
Microsoft Defender Antivirus detects ChainDrop as: Trojan:NPM/ShaiLoader.BY, Trojan:NPM/MalBun.A, Trojan:NPM/ShaiWorm.DAY!MTB, Behavior:Linux/SuspBunActivity.A, Behavior:Win32/SuspBunActivity.A. Defender for Endpoint: "Suspicious Node.js process behavior", "Suspicious usage of Bun runtime", "Suspicious script execution via Bun". Defender for Cloud: "Suspicious npm supply-chain compromise activity detected". | ||
Microsoft Defender for Endpoint hunting query for credential access: alert on gh auth token, gcloud config config-helper, az account get-access-token, or azd auth token invocations where the initiating process is bun or bun.exe with a folder path containing "bun-dl-" or node_modules. | ||
If a compromised package version was installed, treat the affected workstation or CI/CD runner as fully compromised. Rebuild from clean backups or from scratch. Rotate all secrets accessible from that environment: npm tokens, GitHub tokens, AWS credentials, SSH keys, Kubernetes configs, Vault tokens, Stripe/Slack/Twilio API keys. Purge npm and yarn caches. Validate that downstream build artifacts were not produced from the compromised dependency baseline. |