Poisoned NPM Update Hijacks 500M Weekly Downloads

Keyword: npm supply chain attack

Over 2,200 malicious versions of 440 npm packages were published and downloaded in under four hours on August 4, according to a joint analysis by multiple cybersecurity firms. This wasn't a broad hacking campaign. It was a supply chain attack dubbed ChainDrop that started when a single maintainer's GitHub account was compromised. The ripple effect touched code that receives over 500 million weekly downloads, highlighting a critical fragility in modern software development.

The attack is the latest in a series linked to the Shai-Hulud malware family. But as SecurityWeek reports, this variant evolved with a new command-and-control trick and a devastatingly efficient method of self-propagation. It didn't just steal data, it stole the very identities needed to publish more malicious code, creating a digital wildfire.

A Single Account, 400 Infected Projects

The ChainDrop npm supply chain attack began when attackers compromised the GitHub account of a developer maintaining packages in the keyv and cacheable namespaces. Popular projects like keyv alone see over 150 million weekly downloads. The attackers then published poisoned new versions of these packages directly, exploiting the trust in the maintainer and the automated pipelines they use.

“The compromise was carried out by pushing malicious files directly to the main branch and then immediately cutting a new release, meaning the poisoned versions were published to npm with valid provenance signed by GitHub Actions,” researchers from Aikido Security noted.

This provenance validation made the malicious updates appear legitimate, bypassing initial scrutiny. The infected packages executed a malicious preinstall script during the standard npm install command, dropping a second-stage payload before any application code could run.

Key Attack Vectors:

The malware's speed was staggering. StepSecurity tracked the publication of 2,212 malicious package versions in under four hours, starting around 09:35 UTC. The attack spread from the initial 11 "seed" packages to infect 433 additional packages as it hijacked other developers' credentials in an automated loop. This mirrors the automated, self-initiating threat landscape described in our report on Silicon Dust Precedes Troops as Cyber War Becomes First Strike.

Hunt, Steal, Repeat: The Malware's Automated Cycle

Once installed, the ChainDrop payload had a clear, multi-stage mission. It wasn't designed to crash systems but to loot them and then use the stolen goods to fund its next wave.

First, it hunted for secrets across developer workstations and CI/CD environments. Its targets included:

• NPM publishing tokens and GitHub personal access tokens or SSH keys.
• Cloud credentials for AWS, Google Cloud, Azure, Alibaba Cloud, and Tencent Cloud.
• Infrastructure secrets for Kubernetes and HashiCorp Vault.
• AI tool configurations for Claude, OpenAI, Cursor, and others.
• Cryptocurrency keystores and even system files like /etc/shadow.

It encrypted the stolen data and exfiltrated it, often to attacker-created public GitHub repositories cheekily described as "Shai-Hulud: Here We Go Again."

Then, Phase Two began: automated propagation.

“After obtaining an NPM publishing token, it enumerates packages available to the compromised identity, downloads their latest tarballs, inserts the malware and setup loader, adds a preinstall hook, increments the patch version, and republishes the modified packages,” Microsoft's analysis explains.

This cycle is what made ChainDrop worm-like. A developer updating a single dependency could unknowingly hand over the keys to every other package they maintained, leading to a cascading infection. The malware also used stolen GitHub credentials to inject backdoors into Claude and Visual Studio Code configs, creating persistence and new infection paths among developers sharing repositories. This evolution towards exploiting AI development tools underscores a growing trend, as seen when AI Agents Hacked Humans in UK Security Test Scandal.

New Tricks: EtherHiding and a Dead Man's Switch

ChainDrop introduced two sophisticated operational security features that set it apart from previous Shai-Hulud variants. Its primary innovation was using the Ethereum blockchain for command-and-control (C&C), a technique called EtherHiding. By storing its C&C server addresses in a smart contract, attackers created a resilient infrastructure that's difficult for law enforcement to take down without disrupting the entire blockchain.

Second, the malware installed a host-level dead man's switch. After gaining persistence on macOS and Linux systems, it would poll the GitHub API using the victim's own stolen token every 60 seconds. If the token was revoked and the API calls started failing, the malware would delete its state and exit. It also had a built-in self-cleanup routine after 24 hours, complicating forensic analysis. These features point to attackers who expect their footholds to be temporary and are focused on maximizing stealth and credential harvest in a narrow window.

What Developers and Organizations Must Do Now

If your system installed any of the affected package versions during the attack window (starting August 4), you must assume it is fully compromised. Removing the package is not enough. The malware's purpose was credential theft, and it likely succeeded.

Immediate Response Checklist:

• Isolate and Rebuild: Treat any machine that ran the install as hostile. Isolate it, preserve logs for investigation, and rebuild it from a clean image.
• Rotate Every Credential: This is the most critical step. Rotate all NPM tokens, GitHub PATs and SSH keys, cloud provider credentials, Kubernetes service accounts, and any secrets in environment variables or .env files present at install time.
• Audit GitHub Repositories: Search for anomalous commits, new GitHub Actions workflows, or injected files like tasks.json or Claude configs.

Long-Term Defense Adjustments:

• Script Gating: Use the --ignore-scripts flag in CI/CD pipelines. This would have blocked the preinstall script that delivered ChainDrop's payload.
• Minimum Release Age: Configure your package manager to delay pulling new releases by 3-7 days. This "cooling-off" period allows security scanners to catch malicious versions before they hit your build.
• Strict Token Scoping: Limit NPM tokens to the minimal necessary permissions (e.g., read-only for CI, publish only for specific packages) and use short-lived credentials where possible.

The ChainDrop npm supply chain attack proves that the weakest link in software security is often the invisible chain of trust between developers and their tools. The next attack might not start with a stolen password. It could start with a routine update. Defense now requires assuming that any new code, even from a trusted source, could be weaponized the moment it's published. Your build pipeline needs to be as skeptical as your firewall.

Impact Analysis

• The attack targeted foundational code libraries downloaded over 500 million times per week, meaning countless applications and websites could now be compromised.
• It exploited trusted developer accounts and automated pipelines, undermining the security model that modern software development relies on.
• The attackers stole digital identities to self-propagate, demonstrating a scalable method for future, even larger-scale supply chain attacks.