Loading malware…
ChainDrop is a self-propagating npm supply-chain worm and credential-stealing malware strain derived from the Shai-Hulud or Mini Shai-Hulud lineage. It emerged in August 2026 after attackers compromised npm maintainer and GitHub publishing access associated with widely used JavaScript packages, then inserted malicious preinstall logic into legitimate package releases. The malware preserves normal package functionality while adding install-time execution, allowing routine dependency installation on developer workstations and CI/CD runners to trigger compromise.
Execution is typically initiated through malicious npm preinstall lifecycle scripts that launch a dropper and an obfuscated JavaScript payload, often via the Bun runtime. Once active, ChainDrop harvests a broad range of secrets from local files, environment variables, shell history, SSH material, developer-tool configuration, cloud and container tooling, Kubernetes and Vault data, and CI/CD contexts. Multiple reports also describe theft of npm tokens, GitHub credentials, cloud-provider credentials, and extraction of temporary secrets from GitHub Actions runner memory. Stolen data is compressed and encrypted before exfiltration.
ChainDrop’s defining behavior is autonomous propagation. When it obtains npm publishing credentials with sufficient rights, it enumerates packages writable by the victim, injects its malicious components into package archives or repositories, modifies lifecycle scripts, increments package versions, and republishes trojanized releases through legitimate maintainer identities and trusted CI/CD workflows. This enabled rapid spread across hundreds of packages and, in some reporting, well over a thousand package versions. The campaign abused legitimate GitHub Actions and trusted publishing paths, allowing malicious releases to retain valid provenance artifacts in some cases.
The malware also establishes persistence in developer environments by planting hooks in repository settings used by Visual Studio Code and Claude Code so that opening a workspace or starting an AI-assisted coding session can re-trigger execution even without a fresh package install. Some reporting further describes fallback exfiltration through public GitHub repositories created under victim identities and dynamic command-and-control resolution via an Ethereum smart contract, complicating infrastructure-based blocking.
ChainDrop has been linked by multiple researchers to the broader Shai-Hulud ecosystem and associated by some reporting with TeamPCP, although operator attribution is not uniformly confirmed. Its impact extends beyond endpoint compromise to software release pipelines, source repositories, package registries, and cloud infrastructure, making it a high-severity software supply-chain threat to JavaScript development environments and organizations that consume affected npm packages.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
On August 4, 2026, a self-propagating worm called ChainDrop entered the npm ecosystem through a compromised maintainer account. ChainDrop is a variant of Mini Shai-Hulud linked to TeamPCP.
The attackers trojanized the monorepo and embedded a self-propagating worm called CHAINDROP that uses stolen npm credentials to automatically backdoor every other package the maintainer had publish rights to.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
Should it find an npm token, it then downloads the tarballs of all the packages that token has full access to... It also searches for GitHub credentials.
If it finds any, it queries the GitHub API to list all accessible repositories and branches
Execution: Used a preinstall hook to download the Bun runtime and execute the obfuscated Math_Symbol.js payload. | Downloads the Bun JavaScript runtime v1.3.13 directly from its official GitHub release page. Launches the second-stage payload via Bun.
Even if you never install an infected package (“ npm install ” in npm argot), you can still get the nasties – though that is one possible route of infection.
Should it find an npm token, it then downloads the tarballs of all the packages that token has full access to... It also searches for GitHub credentials.
Should it find an npm token, it then downloads the tarballs of all the packages that token has full access to... It also searches for GitHub credentials.
Revoking a stolen token triggers the daemon to execute rm -rf ~/, wiping the victim’s entire home directory including source code, SSH keys, and cloud credentials.
Should it find an npm token, it then downloads the tarballs of all the packages that token has full access to... It also searches for GitHub credentials.
If it finds any, it queries the GitHub API to list all accessible repositories and branches
Checks for a Russian-language system locale; if found, it exits without executing. This is a common evasion technique used to avoid targeting certain regions.
It looks in shell configurations, environment variables and even live memory.
When executed, the software scours the user’s workspace for npm tokens with full write privileges
When executed, the software scours the user’s workspace for npm tokens with full write privileges, as well as for other credentials like cloud keys and secrets.
It looks in shell configurations, environment variables and even live memory.
It looks in shell configurations, environment variables and even live memory.
The malicious packages contain an infostealer designed to harvest npm and GitHub tokens, AWS credentials, Kubernetes secrets, HashiCorp Vault tokens, Stripe and Slack tokens...
The malicious packages contain an infostealer designed to harvest... and perform a generic file system scan.
Checks for a Russian-language system locale; if found, it exits without executing. This is a common evasion technique used to avoid targeting certain regions.
The C2 infrastructure is anchored in an Ethereum smart contract. The attacker can rotate C2 domains without modifying the deployed malware, making blocklists and DNS sinkholes ineffective.
Dabei lädt der stark verschleierte Dropper setup.mjs die Bun‑JavaScript‑Runtime herunter und führt mit Bun den eigentlichen Schadcode Math_Symbol.js aus.
ChainDrop anchored its C2 infrastructure in an Ethereum smart contract, allowing the attacker to rotate domains with a single blockchain transaction and rendering domain-based blocklists ineffective. If GitHub exfiltration fails, the malware calls an Ethereum smart contract ... via eth_call to retrieve active C2 domains.
24 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A self-propagating npm worm that compromises trusted software release pipelines, steals developer and cloud credentials, republishes infected packages using stolen npm tokens, persists via IDE and AI-tooling hooks, uses Ethereum-based C2 retrieval, and can trigger destructive wiping behavior when stolen tokens are revoked.
A self-propagating npm supply chain malware variant that executes via malicious preinstall scripts, steals and validates credentials from developer workstations and CI/CD environments, enumerates GitHub, AWS, Kubernetes, and Vault access, exfiltrates data, modifies repositories for persistence, and republishes compromised npm packages using stolen publisher credentials.
A self-propagating npm supply-chain worm that infects legitimate package releases, executes at install time, steals npm/GitHub/cloud/SSH credentials and other secrets, scrapes GitHub Actions runner memory for temporary secrets, republishes additional packages using stolen npm publishing tokens, establishes persistence via developer tool/project settings, and exfiltrates data through repository-based channels and C2 infrastructure resolved via an Ethereum smart contract.
A self-propagating npm supply-chain worm that infects legitimate package releases, executes at install time, steals npm and GitHub tokens, cloud credentials, SSH keys, environment files, and CI secrets from GitHub Actions runner memory, then uses stolen publishing credentials to modify and republish additional packages for further spread and persistence.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.