Security researchers identified a major software supply chain campaign dubbed “ChainDrop,” in which a self-propagating worm compromised hundreds of npm packages and spread malicious updates through legitimate software development infrastructure. The campaign began after attackers compromised the GitHub account of a maintainer associated with the widely used Keyv and Cacheable JavaScript libraries. Researchers identified more than 400 compromised packages, with the affected packages collectively representing approximately 2 billion monthly downloads. The scale of the campaign means that organizations may have unknowingly incorporated malicious code into development environments, applications, and CI/CD pipelines through otherwise trusted dependencies.

ChainDrop is particularly concerning because it can use stolen npm authentication tokens to propagate from one compromised package to others that the affected maintainer can access. The malware is designed to collect sensitive credentials and secrets from developer environments, including npm tokens and cloud credentials, before exfiltrating the information to attacker-controlled infrastructure. Researchers also observed the malware using legitimate GitHub workflows and package publishing mechanisms to distribute malicious versions, making the activity more difficult to distinguish from normal software development activity. The campaign represents a significant escalation in software supply chain risk because a compromise of a single trusted developer account can potentially provide attackers with access to numerous downstream projects.

The incident demonstrates the broader risk created by the highly interconnected nature of modern open-source software. Organizations may not directly use an affected package but can still be exposed through transitive dependencies within their applications. Security teams should therefore review npm dependency trees for affected versions, investigate developer workstations and CI/CD runners that installed compromised packages, and rotate npm, GitHub, cloud, and other credentials that may have been accessible during exposure. The campaign also reinforces the need for strong multi-factor authentication, short-lived and narrowly scoped CI/CD tokens, dependency pinning, software composition analysis, and continuous monitoring of package publishing activity.