ChainDrop: Inside a Self-Propagating npm Worm

Threat Research Center<br>High Profile Threats<br>Malware

Malware<br>ChainDrop: Inside a Self-Propagating npm Worm

20 min read

Related ProductsAdvanced DNS SecurityAdvanced URL FilteringAdvanced WildFireCloud-Delivered Security ServicesCortexCortex CloudCortex XDRCortex XSIAMUnit 42 Cloud Security AssessmentUnit 42 Incident Response

By:Unit 42

Published:August 6, 2026

Categories:High Profile Threats<br>Malware

Tags:Blockchain<br>ChainDrop<br>Claude code<br>Developer tooling<br>GitHub

Share

Executive Summary

A self-propagating npm worm nicknamed ChainDrop infected over 400 packages that are collectively downloaded hundreds of millions of times each week. This includes malicious versions of widely used packages such as keyv and cacheable-request. Unit 42 has unique observations of this attack.

The attackers behind ChainDrop potentially exposed developer workstations, continuous integration (CI) pipelines, cloud environments and downstream software users across a large number of organizations.

Once installed, ChainDrop steals:

Cloud credentials

npm and GitHub tokens

SSH keys

Other sensitive developer data

It can also extract temporary credentials from GitHub Actions runner memory and use stolen npm publishing tokens to infect and republish additional packages while preserving their legitimate functionality.

We have observed active attempted operations, which were detected out of the box by our existing products.

During our investigation into this attack, we identified 453 public GitHub repositories across five accounts matching the worm’s exfiltration patterns. We also detected ChainDrop execution across 10 distinct environments. At the time of publication, these repos were removed.

We have deobfuscated the malware and identified:

Persistence through developer and AI coding tools

Blockchain-based command-and-control (C2) resolution

Its ability to execute additional attacker-supplied code

Additionally, late on Aug. 4, 2026, we observed the adversary silently reconfiguring the worm's entire C2 infrastructure through a single Ethereum transaction, without requiring any update to the deployed malware.

This attack is the latest in a series of threats to the security of the npm ecosystem.

Unit 42 recommends:

Identifying installations of affected npm package versions

Removing affected package versions

Investigating developer workstations and CI runners for signs of compromise

Reviewing unexpected npm publishing and GitHub repository activity.

Revoking and rotating potentially exposed npm, GitHub, cloud, SSH and automation credentials.

Removing identified persistence mechanisms

Blocking both the domain-based and GitHub-based exfiltration channels

The Koi Agentic Endpoint Security risk engine flagged the malicious package activity as the attack unfolded. Cortex XDR detected and alerted on the worm’s execution using out-of-the-box behavioral detections.

Palo Alto Networks customers can use Koi Agentic Endpoint Security to help identify and control malicious packages across developer endpoints.

The Cortex AgentiX Threat Intel agent can help allow analysts to extract, enrich, and search IoCs using natural language to quickly determine organizational impact.

Cortex Cloud Endpoint Protection leverages AI-enabled analytics to help detect and prevent threats targeting Linux endpoints, containers, and associated cloud IAM policies.

Cortex XDR and XSIAM provide behavioral detection, investigation and response that can help organizations address ChainDrop activity executing in development environments.

Idira Secrets Manager and Secrets Hub eliminate hard-coded credentials from configure files and  source code by automating zero-downtime rotation, and dynamically delivering just-in-time access to non-human identities across multi-cloud and DevOps environments.

The Unit 42 Cloud Security Assessment is an evaluation service that reviews cloud infrastructure to identify misconfigurations and security gaps.

The Unit 42 Incident Response team can also be engaged to help with a compromise or to provide a proactive assessment to lower your risk.

Related Unit 42 Topics<br>AI, Malware, Supply Chain, npm Packages

Details of the ChainDrop npm Worm

Indicators and Behavior of the ChainDrop Worm

We analyzed the contents from one of the infected packages to understand the full attack chain.

The package contained the legitimate software development kit (SDK) code that a user would expect, including the source, dependencies and documentation. But it also contained small indicators of the ChainDrop worm: two extra top-level files and one lifecycle hook.

The indicators of the worm can be subtle, as illustrated in the following example.

One of the indicators is an infected npm package's package.json file containing code with the preinstall command, as shown in Figure 1.

Figure 1. An infected npm package's package.json file containing code with the preinstall command.<br>That...