Skip to content
supplychainattack.orgSupply chain attack incident catalog
activecritical

ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2

ChainDrop is a self-propagating npm worm that publishes malicious versions of dozens of npm packages using stolen maintainer credentials. The worm harvests CI/CD credentials and uses an Ethereum-based dead-drop command-and-control mechanism.

ShareXLinkedInHacker News
Disclosed
Last updated
Blast radius
Dozens of npm packages affected; potential impact on CI/CD systems and credential exposure across dependent projects
Ecosystems
npmOther
Attack vectors
Compromised packageMalicious maintainerAccount takeover
Threat actor
Chaindrop
Affected entities
  • Multiple npm packagesDozens of packages compromised via stolen maintainer credentials; specific package names not listed in provided text

ChainDrop is an active npm worm campaign that exploits compromised maintainer accounts to publish malicious versions of multiple npm packages. The attack leverages stolen credentials to gain publishing rights and distribute the worm across the npm ecosystem.

The malicious packages are designed to harvest CI/CD credentials from affected systems. The worm includes a self-propagating mechanism, allowing it to spread to additional packages and systems. Command-and-control communication is facilitated through an Ethereum-based dead-drop mechanism, which provides a decentralized and difficult-to-disrupt communication channel.

The attack demonstrates a sophisticated supply chain compromise targeting the npm ecosystem and CI/CD infrastructure. The use of stolen maintainer credentials and self-propagating code represents a significant threat to downstream consumers of affected packages.

Indicators of compromise

Packages
  • ChainDrop (worm name)

Remediation

  • Identify and audit all npm packages published by potentially compromised maintainer accounts
  • Review CI/CD logs for suspicious credential access or exfiltration
  • Rotate all CI/CD credentials and secrets that may have been exposed
  • Audit npm package dependencies for malicious versions published during the compromise window
  • Implement stricter access controls and multi-factor authentication for npm maintainer accounts
  • Monitor for signs of credential harvesting in CI/CD systems
  • Review blockchain/Ethereum transaction logs for indicators of C2 communication

Sources

  1. ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 · StepSecurity

Cite this entry

"ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2." supplychainattack.org, Supply Chain Attack Incident Catalog. Disclosed August 4, 2026; last updated August 4, 2026. https://supplychainattack.org/incident/chaindrop-npm-worm-bun-loaded-ci-cd-credential-harvester-with-ethereum-dead-drop-muh58q

Suggest a correction

Found an error or have a newer source? Corrections to factual errors take priority over new entries.

Related incidents

  1. activecritical

    The Worm That Keeps on Digging: TeamPCP Hits @antv in Latest Wave

    TeamPCP conducted a multi-ecosystem supply chain compromise targeting the @antv package and associated development infrastructure. The attack leveraged GitHub, NPM, and VSCode to steal credentials and establish persistence mechanisms.

    TeamPCPnpmOtherAccount takeoverCompromised packageMalicious maintainer
  2. activecritical

    Malicious code in @antv/gi-assets-graphscope (npm)

    A threat actor compromised the npm account 'atool' and published 631 malicious versions across 314 npm packages in a 22-minute automated burst, including @antv/gi-assets-graphscope. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.

    Mini Shai HuludnpmOtherAccount takeoverCompromised packageMalicious commit
  3. containedcritical

    Malicious code in @antv/gi-assets-basic (npm)

    A threat actor compromised the npm account 'atool' and published 631 malicious versions across 314 npm packages, including @antv/gi-assets-basic, in an automated 22-minute burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.

    Mini Shai HuludnpmOtherAccount takeoverCompromised packageMalicious commit
  4. containedcritical

    Malicious code in @antv/g6-extension-3d (npm)

    A threat actor compromised the npm account `atool` and published 631 malicious versions across 314 npm packages, including @antv/g6-extension-3d, in a 22-minute automated burst. Each malicious version injects a preinstall hook executing an obfuscated Bun script that exfiltrates credentials and establishes persistence via CI/CD workflow injection and system daemons.

    Mini Shai HuludnpmOtherAccount takeoverCompromised packageMalicious commit