{"id":182783,"date":"2026-08-10T19:40:40","date_gmt":"2026-08-10T17:40:40","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov"},"modified":"2026-08-12T20:28:40","modified_gmt":"2026-08-12T18:28:40","slug":"novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/novyj-cherv-chaindrop-porazil-bolee-400-npm-paketov","title":{"rendered":"The new worm ChainDrop has affected over 400 NPM packages.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

Registered<\/a> a mass attack on packages in the NPM repository, carried out using a new self-replicating worm called ChainDrop, which injects malware into dependencies. As a result of the attack, 2,212 malicious releases were published for 444 packages. The most popular compromised packages keyv, flat-cache, and file-entry-cache have 154, 149.9, and 147.6 million downloads per week, respectively.<\/p>\n

 <\/p>\n

The worm loader was embedded in the setup.mjs and Math_Symbol.js files, which were executed using a preinstall handler (\"preinstall\": \"node setup.mjs\") triggered during the installation of the affected package. The specified scripts loaded a legitimate Bun runtime and obfuscated worm code, totaling 710 KB. Upon activation, the worm searched the system and environment variables for tokens related to NPM, PyPI, CircleCI, AWS, GCP, Docker, Azure, HashiCorp, Kubernetes (K8s), and other services (analyzing more than 140 file paths, such as ~\/.npmrc), while also scanning the memory (via \/proc\/\/mem) of the GitHub Actions environment for tokens and credentials.<\/p>\n

 <\/p>\n

If a token for connecting to the NPM registry was found, the worm automatically published new malicious releases for packages being developed in the current environment, infecting the dependency tree. Unlike the previously discovered worm Shai-Hulud 2.0<\/a> , ChainDrop employed EtherHiding techniques to receive commands via the public Ethereum blockchain, used encryption to obscure sensitive data sent to the attack server, and facilitated the insertion of its code into configuration files for Claude Code, VS Code, and GitHub Copilot to maintain its presence in the system.<\/p>\n

 <\/p>\n

The attack began with the compromise of the release process based on GitHub Actions for the package keyv<\/a>, which has 154 million downloads per week and is used as a dependency in 1,703 packages. The attackers created a new version 6.0.0, injecting malicious code, and published it using the \"Trusted Publishers<\/a>\" mechanism and proper SLSA certification<\/a>. After publication, the worm affected many packages dependent on keyv and, in turn, began infecting indirect dependencies.<\/p>\n

 <\/p>\n

Among the most popular packages that were infected by the worm, which published malicious releases for them, are:<\/p>\n