Forest Global Training Partners

Cyber Risks · Unit 42 Palo Alto Networks

Chain Drop: Inside a Self-Propagating npm Worm

Summary: A self-propagating npm worm called ChainDrop infected more than 400 packages that are collectively downloaded hundreds of millions of times each week, including malicious versions of keyv and cacheable-request. Unit 42 found 453 public GitHub repositories across five accounts matching the worm's exfiltration patterns and detected ChainDrop execution in 10 distinct environments, and on Aug. 4, 2026, the adversary reconfigured the worm's entire command-and-control infrastructure through a single Ethereum transaction without updating the deployed malware.

Key Takeaway: The worm pulls OIDC tokens and runner secrets straight out of GitHub Actions process memory, so credentials designed to vanish when a job ends are captured before they do. And because it publishes through npm's trusted-publishing exchange, a package with valid provenance can still be attacker-built - the signature only proves which workflow produced the tarball.

Read the original at Unit 42 Palo Alto Networks ↗

Topics
Malware
Related