Related Families: Mini Shai-Hulud, ChainDrop
Executive Summary
Industry researchers identified a large-scale software supply chain attack involving more than 400 compromised npm packages distributed across multiple unrelated publishers. The campaign delivers a new variant of the Mini Shai-Hulud malware, dubbed ChainDrop, through malicious preinstall lifecycle scripts, enabling credential theft, cloud and infrastructure enumeration, repository compromise, and automated propagation using stolen npm publishing credentials. By targeting both developer workstations and CI/CD environments, the campaign demonstrates how modern software supply chain attacks increasingly leverage trusted developer identities to compromise downstream software ecosystems.
Key Takeaways
- A self-propagating software supply chain worm compromised more than 400 npm packages by abusing stolen publisher credentials to automatically modify and republish legitimate software releases.
- The malware targets developer workstations and CI/CD environments, harvesting credentials for npm, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault before validating access and enumerating additional resources.
- Unlike many recent software supply chain attacks that rely on a single malicious package or compromised dependency, the malware autonomously propagates by republishing every package accessible through a compromised maintainer account.
- The campaign also abuses trusted software publishing workflows, enabling malicious packages to be distributed through legitimate release mechanisms while establishing persistence within developer repositories.
Background
Industry researchers identified a large-scale software supply chain attack involving more than 400 compromised npm packages distributed across multiple unrelated publishers. Microsoft's investigation found that the campaign appeared as a rapid sequence of unauthorized patch releases affecting those packages. Evidence presented in the analysis indicates the attackers likely gained their initial access through stolen maintainer credentials before modifying package tarballs directly and publishing malicious versions through legitimate npm accounts. Many of the compromised releases lacked corresponding source-code commits, pull requests, or repository tags, suggesting the public source repositories themselves were not initially compromised.
The malicious packages execute automatically through npm's preinstall lifecycle hook, allowing the payload to run before package installation completes. Upon execution, the malware determines whether it is operating on a developer workstation or within a CI/CD environment and adjusts its behavior to maximize credential collection opportunities available in each environment.
Technical Analysis
The Mini Shai-Hulud variant extends well beyond traditional credential theft. After execution, the malware collects credentials from local files, shell history, environment variables, GitHub Actions runner memory, SSH keys, and cloud configuration files before authenticating to services including npm, GitHub, Amazon Web Services (AWS), Kubernetes, and HashiCorp Vault. Rather than simply identifying tokens, the malware validates available credentials and enumerates repositories, cloud resources, secret stores, and workflow permissions accessible to the compromised identity.
One of the campaign's more notable capabilities is its abuse of GitHub Actions OpenID Connect (OIDC) trusted publishing workflows. Where supported, the malware can leverage legitimate workflow identities to publish malicious packages through trusted publishing mechanisms. Microsoft notes that packages published through this method can carry valid provenance because the publication originates from a legitimate workflow identity.
Collected data is serialized, compressed, encrypted using AES-256-GCM, and protected through RSA-OAEP-SHA256 key exchange before being transmitted to attacker-controlled infrastructure. If the primary exfiltration channel becomes unavailable, the malware can retrieve alternate infrastructure information through additional mechanisms and ultimately create public GitHub repositories as a fallback exfiltration channel.
The malware also establishes persistence by modifying repository configuration files associated with both Claude and Visual Studio Code. These modifications create a secondary infection pathway capable of re-executing the malware during future development activity, extending compromise beyond the original npm package installation.
Perhaps the campaign's defining capability is its automated propagation routine. After identifying npm publishing credentials with package write permissions, the malware downloads the latest package release, inserts its malicious payload and loader, replaces lifecycle scripts, increments the package version, and republishes the modified archive. This worm-like behavior allows a single compromised publishing identity to rapidly propagate malicious updates across every package managed by that publisher.
Organizations that installed affected npm packages with lifecycle scripts enabled should consider associated developer workstations, CI/CD runners, and accessible credentials potentially compromised. Because the malware authenticates directly to cloud platforms, source code repositories, package registries, and secret management platforms, successful infections may extend well beyond the original endpoint to impact software release processes and cloud infrastructure.
The campaign also highlights the growing operational risk associated with trusted publishing identities. Once compromised, legitimate software publishing workflows can enable attackers to distribute malicious software through otherwise trusted release channels, increasing the potential downstream impact across software consumers. This observation reflects Microsoft's documented abuse of GitHub Actions OIDC publishing within the campaign.
Analyst Commentary
While software supply chain attacks have become increasingly common over the past several years, ChainDrop represents a notable evolution in adversary tradecraft. Many previous campaigns focused on poisoning individual packages through techniques such as typosquatting, dependency confusion, or isolated maintainer account compromise. In those cases, the malicious package itself was often the primary objective. By contrast, this campaign treats the software package as an initial access vector into a much larger ecosystem of trusted developer identities, cloud infrastructure, and software release pipelines.
Rather than simply stealing credentials, the malware validates recovered identities, authenticates to cloud platforms and development services, enumerates repositories and secret stores, and uses stolen npm publishing credentials to automatically compromise additional software packages. This automated propagation routine transforms individual maintainer compromises into a scalable worm capable of rapidly expanding across the software supply chain without requiring attackers to manually target each publisher.
Equally significant is the campaign's abuse of trusted software publishing mechanisms. Rather than bypassing modern supply chain security controls, the malware leverages legitimate GitHub Actions OpenID Connect (OIDC) publishing workflows after compromising trusted identities. Packages published through these mechanisms may still carry valid provenance because they originate from legitimate workflow identities. This distinction underscores an important shift in the threat landscape: protecting software artifacts alone is no longer sufficient if the identities responsible for producing them have been compromised.
Defenders should increasingly view developer workstations, CI/CD pipelines, package registries, cloud infrastructure, and secret management platforms as components of a single interconnected attack surface rather than independent security domains. ChainDrop demonstrates that identity has become both the primary target and the mechanism for large-scale propagation, reinforcing that continuous monitoring of developer identities, software publishing workflows, cloud credential usage, and release integrity is now as important as traditional dependency scanning.
PolySwarm's crowdsourced malware detection platform complements this defensive approach by providing independent, multi-engine analysis capable of identifying emerging malware and software supply chain threats that may evade traditional single-vendor detection. Combined with high-quality threat intelligence and continuous monitoring, this layered approach helps organizations detect evolving attacks targeting modern software development environments before they propagate broadly across downstream ecosystems.
IOCs
PolySwarm has a sample of the npm tarball preinstall loader used in this activity.
54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668
Click here to view all samples of ChainDrop in our PolySwarm portal.
Don’t have a PolySwarm account? Go here to sign up for a free Community plan or subscribe.
Contact us at hivemind@polyswarm.io | Check out our blog | Subscribe to our reports.
