Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack
ChainDrop attack infects over 400 NPM packages with malware to steal secrets.
A supply chain attack dubbed ChainDrop has compromised over 400 NPM packages, publishing more than 2,200 malicious versions. The malware steals various credentials, including NPM and GitHub tokens, and uses them to propagate further by publishing poisoned package versions and infecting repositories. It also targets CI/CD environments and cloud infrastructure secrets.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Microsoft?
Get an email when a new story names Microsoft, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe ChainDrop attack exploited the trust developers place in open-source package ecosystems by injecting malware into over 400 NPM packages across 2,200+ malicious versions. Once installed, the malware harvested NPM and GitHub tokens, enabling attackers to self-propagate by publishing further poisoned packages and compromising repositories in a cascading effect. CI/CD pipelines and cloud secrets were also targeted, meaning a single infected dependency could expose an entire production infrastructure. This attack illustrates how stolen developer credentials can become a force multiplier, turning one compromised package into an organization-wide breach.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Mini Shai-Hulud
- malware — ChainDrop
- url — https://github.com/Shai-Hulud/Shai-Hulud