A self-propagating worm that researchers have named ChainDrop tore through the npm registry on August 4, poisoning 444 packages and 2,212 individual versions in under four hours, and the reason it slipped past standard defenses is the uncomfortable part: many of the malicious releases arrived cryptographically signed, with valid provenance attestations, published by the victims' own release workflows.
The blast radius is enormous because the earliest carriers were caching libraries that almost nothing in JavaScript avoids โ poisoned builds of keyv, flat-cache, and file-entry-cache each draw roughly 150 million weekly downloads and sit deep inside toolchains from ESLint to anything built on cache-manager, so one compromised patch release lands in lockfiles no developer consciously chose. Transitive dependency depth, not carelessness, is what makes this class of attack so efficient.
How the payload works
Every infected release follows the same recipe, which Microsoft Threat Intelligence classifies as a Mini Shai-Hulud variant: a preinstall lifecycle hook fires before installation finishes, fetches the legitimate Bun JavaScript runtime, and executes a roughly 710KB obfuscated second stage on workstations and build runners ahead of test suites or conventional scanning. Timing is the whole trick โ a scanner that inspects a dependency after install has already lost.
The malware then branches on where it landed, detaching into the background on a developer machine while deliberately staying attached inside CI so it can reach workflow secrets, runner credentials, and OpenID Connect publishing permissions. It sweeps environment variables, shell histories, SSH keys, and cloud configuration before authenticating to npm, GitHub, AWS, Kubernetes, and HashiCorp Vault to call those APIs directly and harvest whatever else the stolen identity is allowed to see. That last step is what distinguishes it from ordinary token scrapers, which stop at pattern-matching files on disk.
Exfiltration is layered: the haul is compressed, encrypted, and pushed to an attacker-controlled HTTPS endpoint with GitHub repositories as fallback, while command and control runs through the Ethereum blockchain in a dead-drop pattern known as EtherHiding that leaves defenders nothing to seize or sinkhole. Propagation then closes the loop, as a stolen publishing token lets the worm enumerate reachable packages, inject itself into the newest tarball, bump the patch version, and republish โ turning a single compromised maintainer into hundreds of malicious releases within hours.
Why provenance did not save anyone
Supply chain defenders spent the past two years telling teams to demand signed provenance, and the March 2026 axios compromise reinforced that advice because the missing attestation was the giveaway. ChainDrop inverts the lesson: the attacker took over a maintainer's GitHub account, pushed poisoned release commits and tags, and let the project's own trusted-publishing workflow build and sign the malware, because an attestation proves which commit produced a build and says nothing about whether that commit was authorized.
Investigators also found malicious versions with no matching commit, pull request, or tag, meaning the attackers republished modified tarballs directly instead of touching the public source repository at all. Until registries can bind releases to reviewed changes, that mismatch between published artifact and repository history remains one of the few reliable detection signals teams can automate.
The economics here favor the attacker in a way that policy has not caught up with. A registry optimized for instant publication and automatic patch upgrades rewards speed at every layer, and the same defaults that let a maintainer ship a bug fix within minutes let a worm ship itself within minutes. Npm's move toward trusted publishing was meant to shrink the credential attack surface, and it did โ but it also concentrated trust in a maintainer's identity provider account, which is exactly where this campaign struck. Account takeover, not token theft, is now the highest-leverage move available against open source distribution.
AI tooling as a persistence layer
The detail that should worry teams running AI coding assistants is where the worm hides: with stolen GitHub credentials it writes Claude Code, Visual Studio Code, and Copilot workflow configuration into repository branches, converting agent config into both persistence and a developer-to-developer infection path. Editor and agent settings are rarely code-reviewed, which is precisely why they make effective hiding places, and cleaning the dependency tree without auditing them leaves the door open.
Guidance from Microsoft and the researchers tracking the campaign is blunt: treat any workstation or runner that installed an affected version with lifecycle scripts enabled as compromised outright, rotate credentials from a known-clean environment, and rebuild downstream artifacts from trusted sources rather than patching in place. Hardening for the next wave is unglamorous โ disable install scripts by default with the ignore-scripts flag, pin exact versions, scope publishing tokens narrowly, and review any dependency update that introduces a preinstall hook.
