A self-propagating worm-like attack is hitting the npm registry, having infected 444 packages from more than a dozen publishers so far. The impact is massive, with the packages affected amounting to more than 2 billion monthly downloads combined.
The attack began with the compromise of a GitHub account belonging to Jared Wray, who maintains Keyv, a package with over 150 million weekly downloads that provides an interface for interacting with key-value storage across multiple backends. Version 6.0.0 published at around 9:00 UTC on Tuesday contained a new version of the Shai-Hulud credential stealing malware.
The compromised account is also used to maintain a number of other popular packages, including cacheable, flat-cache, file-entry-cache, cacheable-request, cache-manager, ecto, and more. All of these had trojanized versions published as well.
Soon after, the attack expanded beyond this account, infecting packages from other organizations on npm — @deliveroo/reevent, @or-sdk/invitations , @picsart/ai-sdk, @qlik/embed-runtime, picasso.js, to name a few. As of 18:10 UTC, StepSecurity had detected the malicious code across 444 packages and 2,212 versions.
“Every poisoned version carries the same infection pattern: a preinstall dropper that downloads the legitimate Bun JavaScript runtime, and a 710KB obfuscated second stage that steals credentials, publishes more malicious packages, and burrows into AI developer tooling,” researchers from StepSecurity said.
Although the code appears to be a new variant of Shai-Hulud — a supply-chain credential stealing worm that has plagued the npm and PyPI repositories since last year in different variations — researchers have decided to dub this new attack campaign ChainDrop because this new version uses the Ethereum blockchain for command and control, a technique known as EtherHiding.
“The compromise was carried out by pushing malicious files directly to the main branch and then immediately cutting a new release, meaning the poisoned versions were published to npm with valid provenance signed by GitHub Actions,” researchers from Aikido Security said in a report.
Wray confirmed via X that he uses OpenID Connect (OIDC) with npm and one-time codes for GitHub, so he was not using long-term static tokens. The developer regained access to his GitHub account at around 20:00 UTC and said he’s doing a full audit.
The malware infects AI code assistants
The malicious files added to packages are setup.mjs and Math_Symbol.js — renamed math_init.js in some cases. These get executed by a preinstall script during the npm installation process of the packages and then proceed to download and execute a secondary obfuscated payload on the computer.
The malware searches the local environment for cloud credentials, infrastructure secrets, developer access tokens, AI-related configuration files, and cryptocurrency wallets. It also identifies CI/CD workflows and build runners and tries to scrape their memory for temporary secrets injected during the build process.
New to this variant are persistent mechanisms deployed inside code editors such as VS Code via tasks.json and AI code assistants such as Claude Code through hooks.
“Targets for credential theft have been expanded by almost 70%, with new additions including AI-agent credential stores for Claude, OpenAI, Codex, Cursor and Gemini; cryptocurrency keystores for Foundry, Solana and Monero; self-hosted CI and registry secrets such as Jenkins’ master.key, Argo CD and Harbor; Alibaba Cloud and Tencent Cloud CLI configurations; and system files including /etc/shadow,” researchers from security firm Wiz said in their own analysis.
Mitigation
Unfortunately, enterprise security teams must perform full audits of developer machines. The compromised packages are transient dependencies for thousands of others and if any of the poisoned versions were installed during the attack window, all possible credentials accessible on that machine, or other machines accessible from that machine, need to be rotated.
“Rotate, at minimum: npm automation tokens, GitHub personal access tokens and SSH keys, cloud provider credentials (~/.aws, ~/.config/gcloud, Azure), Kubernetes service accounts, and any secrets in environment variables or .env files present at install time,” the StepSecurity researchers said. “Maintainers of npm packages should treat their publish credentials as exposed. The second wave of this campaign demonstrates exactly why: additional maintainer accounts published the identical payload within the same hour.”
The StepSecurity report includes indicators of compromise, a list of infected packages, as well as defense-in-depth recommendations for developer machines and processes that could have stopped this compromise.
Using the -—ignore-scripts npm flag in CI workflows, a technique known as script gating, would have ignored the preinstall script that delivers the payload. Package managers like npm, pnpm, Yarn and Bun now support minimum release age policies for package installation. Configuring this setting to between 3 to 7 days buys users some time in case a newly released version turns out to be poisoned.
Security companies continuously scan and monitor the npm registry and new supply chain compromises are usually discovered within minutes or hours. In this case the malicious versions began being removed by the npm team within two hours, but being a worm, the attack keeps propagating via newly compromised developer accounts.
No Responses