You know that feeling when you install one innocent-looking caching library and somehow your GitHub tokens, cloud credentials, and Kubernetes secrets all pack their bags and leave without saying goodbye? That's the ChainDrop attack in a nutshell, and it's currently doing laps around the npm ecosystem like it owns the place.

One Stolen Login, 400-Plus Poisoned Packages

ChainDrop, the latest strain of the self-propagating Shai-Hulud worm, kicked off after attackers compromised the GitHub account of the maintainer behind the popular keyv caching package family. From there it spread fast, poisoning over 400 npm packages across multiple unrelated publishers, including widely used libraries like flat-cache and cache-manager, collectively representing billions of monthly installs.

The payload rides in on an npm preinstall lifecycle hook, meaning the malicious code runs automatically the moment a package installs, before a developer even gets a chance to look at what they just pulled down. Once active, it hunts developer workstations and CI/CD environments for npm, GitHub, cloud, and infrastructure credentials.

A Worm That Publishes Its Own Sequels

Here's the genuinely alarming part: ChainDrop doesn't just steal credentials, it uses them. With a hijacked npm token in hand, it lists every package that token can publish, injects itself into the latest release, bumps the patch version, and republishes — turning one compromised maintainer account into an automated malware factory. Stolen data gets encrypted and shipped out to attacker-controlled endpoints, with public GitHub repos as a backup channel if the primary infrastructure gets taken down.

This is the second high-profile Shai-Hulud-lineage worm to tear through npm this year, which says less about any one maintainer's mistake and more about a structural weakness: a single compromised credential in an ecosystem built on deep, often invisible dependency chains can cascade into thousands of poisoned packages within hours. Microsoft's advice is blunt — update npm CLI, rotate every credential from a clean machine, purge caches, and rebuild artifacts from trusted sources rather than trusting anything built during the exposure window.

Supply chain security isn't a buzzword anymore — it's the thing standing between your build server and a very bad Tuesday.

Want a practical way to guard against this stuff? Our free Security Checklist is a good place to start.

Source: Microsoft Security Blog