A novel iteration of the Shai-Hulud worm recently infected 444 distinct npm packages. These specific packages collectively experience approximately two billion downloads every month. The extensive casualty list includes highly ubiquitous dependencies such as keyv, flat-cache, and cache-manager.
ChainDrop propagates utilizing a highly unconventional methodology. The malicious code can directly infiltrate published packages while the originating GitHub repository remains entirely unblemished. An auxiliary infection vector specifically targets configuration files utilized by VS Code and Claude Code. Consequently, simply opening a maliciously prepared project branch can initiate an infection sequence.
The Evolution of the Shai-Hulud Worm
Security researchers initially discovered the original Shai-Hulud worm back in September 2025. They named this destructive software after the colossal sandworms from Frank Herbert’s “Dune”. This new variant, identified in August 2026, earned the moniker ChainDrop.
The core infection mechanism evolved significantly. Instead of injecting malicious code exclusively through standard repository modifications, the worm exploits published npm archives. It also actively leverages stolen authentication tokens and specific development tool configurations. Researchers detected this massive campaign on August 4. By that date, the infection had already compromised 444 packages across multiple independent publishers.
The Danger of Deep Dependencies
Crucially, many affected components are not directly installed by developers. Instead, applications pull them in indirectly alongside other necessary dependencies. Therefore, a compromised library might hide deeply within a complex package tree. The application author might never explicitly install it or even realize it exists.
Exploiting VS Code and Tarball Archives
Weaponizing Development Configurations
Standard installation via the npm install command remains a primary vector for executing this malicious payload. However, ChainDrop extends its reach far beyond this single method. The worm maliciously inserts automated startup commands directly into repository configuration files. Specifically, the attackers target .claude/settings.json and .vscode/tasks.json.
These critical files directly dictate the behavior of Claude Code and Visual Studio Code tasks. Suppose an attacker injects a command to launch a malicious script into these files. In that scenario, merely opening the compromised project branch can trigger the next stage of the attack. It requires absolutely no manual execution of the infected program.
Discrepancies Between npm and GitHub
Furthermore, inspecting the original source code will not reliably expose this sophisticated interference. ChainDrop successfully spreads via the tarball archives that npm utilizes to deliver published packages. The precise contents of these archives can differ substantially from the files stored within the linked Git repository. Therefore, the malicious actor does not need to leave a traceable commit within the project’s history.
The Post-Infection Data Theft Process
Harvesting Tokens and Secrets
Following successful execution, ChainDrop immediately scans the host system for highly privileged npm tokens. Simultaneously, the worm harvests various other sensitive secrets, including vital cloud keys and user credentials. This aggressive search encompasses command shell configuration files, system environment variables, and data residing within the active memory of running processes. Finally, the malware encrypts the harvested information and exfiltrates it to attacker-controlled servers.
The Threat of Compromised npm Tokens
Captured npm tokens possessing publish privileges are exceptionally dangerous. Upon securing such a token, ChainDrop identifies every single package the victim can access completely. It then downloads the corresponding tarball archives directly from npm, entirely bypassing the associated Git repository. Next, the worm injects its own malicious payload into the archive and meticulously reassembles the package.
After successful publication, the infected iteration appears live on npm. However, the source project’s version history will likely lack any suspicious alterations. A conscientious developer might scrutinize GitHub, carefully verify the latest commits, and find absolutely no malicious code. This dangerous discrepancy occurs because the infection happened exclusively at the published package level.
Expanding the Infection Radius
Exploiting GitHub API Access
Concurrently, ChainDrop actively hunts for valid GitHub credentials. If it uncovers a suitable token, the malware accesses the GitHub API. It retrieves a comprehensive list of accessible repositories and associated branches. Subsequently, it writes the malicious development tool configuration directly into those locations.
The compromised .claude/settings.json and .vscode/tasks.json files effectively transform the repository into an additional distribution channel. When another developer inevitably opens that prepared branch using Claude Code or Visual Studio Code, a hidden background task initiates secret harvesting on their fresh machine. The newly stolen npm token then grants access to further packages, creating a vicious cycle. The compromised GitHub data facilitates configuration injection into even more repositories.
The CI/CD Pipeline Risk
As a result, ChainDrop advances relentlessly along two distinct trajectories. Through npm, the worm infects published packages without altering the source repository. Through GitHub, it injects execution commands directly into branch utility files. Both mechanisms successfully sustain the infection chain following credential theft.
Automated CI/CD pipelines introduce another layer of profound risk. Numerous projects are configured to automatically fetch the latest dependency patches during the build process. If a compromised package version falls within the specified version range, the build system might download it automatically. The developer does not need to manually modify the source code or update the package themselves.
Mitigation and Necessary Precautions
Verifying Specific Package Versions
Following the discovery of this campaign, administrators rapidly expunged the infected versions from npm. However, simply checking library names is insufficient. Teams must meticulously compare installed version numbers against the official list of compromised releases. SafeDep has publicly released a comprehensive registry detailing the affected components and their specific compromised version numbers.
Scrutinizing Utility Files and Secrets
If developers suspect a compromise, they must actively search for unfamiliar .claude/settings.json and .vscode/tasks.json files. This search is especially critical if project members did not create these files intentionally. Simply checking the main branch is inadequate. The malicious configuration could reside in any branch accessible via the stolen GitHub privileges.
Merely deleting suspicious files will not resolve the underlying problem. ChainDrop specifically targets npm tokens, GitHub data, and cloud keys. Therefore, security teams must consider any credentials discovered on an infected machine as fully compromised. Even after sanitizing a repository, a previously stolen token might retain package publishing rights.
This campaign radically alters how teams must treat utility files within repositories. A development environment configuration can execute commands; therefore, administrators cannot dismiss it as harmless interface settings. Files possessing command execution capabilities demand the exact same rigorous scrutiny as vital build scripts.
Finally, package publication methods require dedicated attention. Transitioning to trusted publishing via GitHub Actions significantly reduces reliance on long-lived, highly privileged npm tokens. The fundamental danger of ChainDrop stems from the gaping disconnect between the source repository contents and the actual files retrieved from npm.
Support Our Threat Intelligence
If you find our technology report and cybersecurity news helpful, consider supporting our work.
Buy Me a Coffee
PayPal
