ChainDrop Worm Infects 444 npm Packages via Tarball Manipulation

A high-impact ChainDrop npm worm campaign has infected 444 open-source packages across the JavaScript ecosystem, circumventing standard repository source code audits by tampering directly with published archive files. Identified by security researchers on August 4, the operation represents a major evolution of the Shai-Hulud npm worm first detected in September 2025. By targeting widely downloaded deep-infrastructure dependencies including keyv, flat-cache, and cache-manager—which collectively account for roughly 2 billion downloads per month—the malware achieved massive potential reach across enterprise CI/CD pipelines and developer workstations.

What makes this campaign notable is its complete decoupling of the malicious payload from the software’s public GitHub repositories, alongside its abuse of modern developer environment automation hooks to self-propagate.

Bypassing Source Audits via Tarball Manipulation

Traditional open-source supply chain defenses rely heavily on monitoring GitHub commits, pull requests, and source diffs. ChainDrop sidesteps these controls by abusing the difference between a project’s source repository and the compiled package tarball (.tgz) uploaded to the npm registry.

When a standard developer publishes a package using the npm publish command, the CLI creates a tarball containing the local build artifacts. ChainDrop targets developers who hold high-privilege npm write tokens. Once execution occurs on a maintainer’s environment, the worm uses the stolen token to pull down the legitimate package tarballs for every project that maintainer has access to.

Instead of modifying the upstream repository code, ChainDrop unpacks the tarball, injects its malicious payload, repacks the archive, and re-publishes it directly to npm as a routine version update. Security teams reviewing the corresponding GitHub repository will find zero evidence of code tampering, commit logs, or malicious pull requests. For organizations performing static analysis strictly on GitHub source repos rather than auditing the published node_modules artifacts, the infection remains entirely invisible.

Weaponizing VS Code and Claude Code Developer Workspace Hooks

Beyond standard package installation hooks (such as postinstall scripts), ChainDrop introduces stealthy propagation hooks embedded directly into developer configuration files. The malware targets workspace settings used by common IDEs and AI coding tools, specifically .vscode/tasks.json and .claude/settings.json.

When an engineer checks out or opens an infected Git branch in Visual Studio Code or Anthropic’s Claude Code interface, these configuration files trigger hidden background execution tasks. The worm runs automatically without requiring the developer to execute npm install or run a build script.

Once executed in a workspace, ChainDrop conducts a aggressive memory and disk credential sweep:

• Disk and Shell: It scans shell configurations (.bashrc, .zshrc), environment variables, and hidden configuration files for cloud access keys, API tokens, and deployment secrets.
• Live Memory: It inspects active process memory to scrape raw tokens that may not be written to disk.
• Token Harvesting: It specifically extracts npm tokens with publish/write rights and GitHub personal access tokens (PATs) or SSH keys.

All exfiltrated credentials are encrypted and sent to attacker-controlled command-and-control endpoints.

CI/CD Pipeline Exploitation and GitHub Propagation

ChainDrop’s propagation strategy operates on a dual loop affecting both package registries and source control platforms:

1. GitHub Branch Contamination: If the harvested credentials include GitHub write access, ChainDrop leverages the GitHub API to list all repositories and branches accessible to the compromised account. It then silently commits its malicious .vscode/tasks.json and .claude/settings.json configurations directly into every available branch. When other software engineers pull those branches, their local environments become infected, continuing the cycle.
2. CI/CD Ingestion: Because enterprise automated build environments frequently pull patch-level updates (^ or ~ semver ranges) during build or test stages, CI/CD runners automatically pull down the poisoned npm tarballs during clean builds. If the CI/CD runner operates with ambient cloud or npm publishing privileges, those pipeline secrets are instantly harvested.

This architecture creates a self-sustaining feedback loop across developer endpoints, cloud build systems, and open-source registries.

Incident Response and Detection Steps

All 444 compromised package versions identified in the August 4 outbreak have been removed from the npm registry. However, due to caching, internal artifact repositories (such as Nexus or JFrog Artifactory), and lockfiles created during the window of compromise, organizations must audit their environments directly.

If you suspect exposure or maintain npm packages that may have been targeted:

• Audit Developer Config Files: Search all Git branches—not just main or default—for unauthorized or unexpected .vscode/tasks.json and .claude/settings.json files. Treat repository configuration files as untrusted, executable content.
• Check Lockfiles Against Compromised Lists: Verify project dependency trees against SafeDep’s published list of affected package versions. Pay special attention to indirect dependencies pulled in by key caching libraries like keyv, flat-cache, and cache-manager.
• Revoke and Rotate Credentials: Any npm write tokens, GitHub PATs, AWS/GCP secrets, or SSH keys present on host machines or build runners where an infected package was fetched must be considered fully compromised and immediately revoked.
• Enforce OIDC and Trusted Publishers: Transition npm publishing workflows away from long-lived automated tokens. Implement granular access tokens or OpenID Connect (OIDC) Trusted Publishing (e.g., GitHub Actions OIDC) to ensure registry publications can only originate from vetted, ephemeral workflow runs rather than developer workstations.