Massive ChainDrop npm supply-chain attack infects hundreds of packages
A massive supply-chain attack has compromised over 1,300 packages on the Node Package Manager (npm) registry, including popular ones like Keyv and Cacheable. The attack, named 'ChainDrop', has been linked to a self-propagating malware that steals sensitive information and…
Intelligence analysis by Llama
A massive supply-chain attack has compromised over 1,300 packages on the npm registry, including popular ones like Keyv and Cacheable. The attack, named 'ChainDrop', has been linked to a self-propagating malware that steals sensitive information and collects developer and cloud credentials.
Imagine you're a developer, and you're using a package manager to install packages for your project. But someone has hacked into the package manager and is secretly installing malware on your computer. The malware is stealing your sensitive information, like passwords and API keys, and sending it to a bad guy's server. This is what's happening in the ChainDrop attack, where over 1,300 packages on the npm registry have been compromised. It's like a big game of 'whack-a-mole' for security teams, who have to keep track of all the different packages and versions to catch the malware before it's too late.
Analysis
A Massive Supply-Chain Attack Unfolds
A massive supply-chain attack has compromised over 1,300 packages on the Node Package Manager (npm) registry, including popular ones like Keyv and Cacheable. The attack, named 'ChainDrop', has been linked to a self-propagating malware that steals sensitive information and collects developer and cloud credentials.
The attack started after the threat actor compromised the GitHub account of Keyv’s maintainer and quickly spread to packages associated with major organizations such as Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan. Multiple application security companies spotted the attack and discovered that it deployed a Shai-Hulud-based worm named ChainDrop.
A report from Aikido says 'at least 868 packages (across 1381 versions) have been compromised by the worm.' The researchers say that the attacker pushed malicious files directly to the projects’ main branches and then generated new package releases. Because the packages were built and published through their legitimate GitHub Actions workflows, the compromised npm releases carried valid provenance information.
The poisoned packages contain two files: the setup.mjs payload dropper and the Math_Symbol.js script for stealing sensitive information, as well as a 'preinstall': 'node setup.mjs' entry in their package.json configuration file. 'Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed,' Aikido researchers warn.
The setup.mjs dropper downloads the Bun JavaScript runtime from the official GitHub release to execute Math_Symbol.js, the malicious payload with infostealing capabilities. execFileSync(<bun binary>, ['<script_dir>/Math_Symbol.js'], { stdio: 'inherit', cwd: <script_dir> }) After downloading the Bun executable to run the infostealer script, setup.mjs deletes the temporary runtime directory.
Aikido notes that the infostealer collects developer and cloud credentials from the compromised environment and encrypts them before sending them to a public GitHub repository with the description 'Shai-Hulud: Here We Go Again.' The malicious JavaScript is heavily obfuscated and includes self-spreading capabilities that allow it to infect packages from other maintainers that used a previously compromised package.
While Aikido found that the Bun executable launched the Math_Symbol.js script, BleepingComputer has also seen compromised npm packages containing the math_init.js script. Obfuscated math_init.js / Math_Symbol.js script source: BleepingComputer Every token is first validated in real-time against registry.npmjs[.]org/-/whoami before being stolen.
The malware searches infected development systems and CI/CD runners for credentials that could grant it access to additional source code repositories and npm packages, and collects the following types of data:
The complete process environment. Local configuration and credential files. GitHub PATs, workflow tokens, and other ghp_, gho_, and ghs_ tokens. npm tokens beginning with npm_ . GitHub Actions secrets, including code designed to extract 'isSecret':true values from a self-hosted runner. AWS credentials, SSM Parameter Store values using WithDecryption: true , and Secrets Manager secrets. Kubernetes secrets from accessible namespaces. HashiCorp Vault tokens and KV secrets. Database credentials, private keys, Stripe, Slack, Twilio, Azure, and GCP credentials.
According to cloud security company Wiz, the 'npm-cache[.]com' domain is also being used for exfiltrating data and should be treated as a strong indicator of compromise.
If an affected package version was installed, system administrators should treat the developer workstation or CI/CD runner as compromised even if the package was subsequently removed. In such instances, it is recommended to rebuild systems from safe backups or from scratch, rotate all tokens that were accessible from the impacted environment, and review logs for unauthorized access and repositories for unexpected commits or changes.
As the attack is still unfolding, the number of packages and exact malicious versions is expected to grow, so it is important to continue using dependency allowlisting, integrity checks, and provenance controls.
Key points
- Over 1,300 packages on the npm registry have been compromised in a massive supply-chain attack.
- The attack, named 'ChainDrop', has been linked to a self-propagating malware that steals sensitive information and collects developer and cloud credentials.
- The malware searches infected development systems and CI/CD runners for credentials that could grant it access to additional source code repositories and npm packages.
- The attack highlights the importance of dependency allowlisting, integrity checks, and provenance controls in preventing supply-chain attacks.
- Security teams should be vigilant in monitoring their environments for signs of compromise and use the right tools and techniques to detect and respond to attacks like this.
While the ChainDrop attack is a significant security threat, it's also a wake-up call for the security community to be more vigilant and proactive in monitoring their environments for signs of compromise. With the right tools and techniques, security teams can detect and respond to attacks like this before they cause too much damage. Additionally, the fact that multiple security companies were able to detect and analyze the attack in real-time suggests that the security community is getting better at sharing information and collaborating to stay ahead of threats.
The ChainDrop attack highlights the ongoing problem of supply-chain attacks, which can have devastating consequences for organizations and individuals. The fact that the malware was able to spread so quickly and widely suggests that there may be other vulnerabilities in the system that need to be addressed. Furthermore, the attack's use of self-spreading capabilities and obfuscated code makes it difficult for security teams to detect and analyze, which could lead to further complications and delays in responding to the attack.
