ChainDrop: Inside a Self-Propagating npm Worm
Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2 routing.
Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2 routing. A self-propagating npm worm nicknamed ChainDrop infected over 400 packages that are collectively downloaded hundreds of millions of times each week. The attackers behind ChainDrop potentially exposed developer workstations, continuous integration (CI) pipelines, cloud environments and downstream software users across a large number of organizations. It can also extract temporary credentials from GitHub Actions runner memory and use stolen npm publishing tokens to infect and republish additional packages while preserving their legitimate functionality.
This is useful for defenders looking for indicators because the worm is chatty. Also, If the worm is placed in a repo that contains /opensearch-js , but does not contain release-drafter.yml , it exits and steals nothing at all.
But it also contained small indicators of the ChainDrop worm: two extra top-level files and one lifecycle hook. One of the indicators is an infected npm package's package.json file containing code with the preinstall command, as shown in Figure 1. The npm and GitHub tokens it finds are what it needs to keep spreading. An embedded Python helper hidden inside an encrypted blob in the payload locates the Runner.Worker process on GitHub Actions runners, opens /proc/ /maps and /proc/ /mem , and searches live process memory for OpenID Connect (OIDC) tokens and runner secrets.
4, 2026, we observed the adversary silently reconfiguring the worm's entire C2 infrastructure through a single Ethereum transaction, without requiring any update to the deployed malware. Cortex XDR detected and alerted on the worm’s execution using out-of-the-box behavioral detections. The indicators of the worm can be subtle, as illustrated in the following example. That preinstall line is the only modification the worm makes to this package's manifest.
However, defenders should remove all five files to be sure the worm is disabled. Before collecting anything, the worm checks three environment variables. Pivot on the Rekor log index and the workflow identity inside the certificate, not on whether the signature checks out. The worm rotates through roughly 60 public Ethereum RPC endpoints until one answers, making it resilient to any single provider blocking the request.
Who is affected
This attack is the latest in a series of threats to the security of the npm ecosystem .
Cortex XDR and XSIAM provide behavioral detection, investigation and response that can help organizations address ChainDrop activity executing in development environments.
These include the following categories: ChainDrop harvests credentials, but also a wide variety of other information about the systems and environment it’s running on.
The worm also carries an installer for a macOS LaunchAgent ( com.user.gh-token-monitor ) and a Linux systemd user service ( gh-token-monitor.service ).
And it creates public repositories under the victim's GitHub account with the description Shai-Hulud: Here We Go Again and Dune-themed names, using them as an additional exfiltration channel.
Why this matters
This is useful for defenders looking for indicators because the worm is chatty.
Also, If the worm is placed in a repo that contains /opensearch-js , but does not contain release-drafter.yml , it exits and steals nothing at all.
The technical picture
But it also contained small indicators of the ChainDrop worm: two extra top-level files and one lifecycle hook.
One of the indicators is an infected npm package's package.json file containing code with the preinstall command, as shown in Figure 1.
The npm and GitHub tokens it finds are what it needs to keep spreading.
An embedded Python helper hidden inside an encrypted blob in the payload locates the Runner.Worker process on GitHub Actions runners, opens /proc/ /maps and /proc/ /mem , and searches live process memory for OpenID Connect (OIDC) tokens and runner secrets.
The flow of this GitHub Actions runner memory scraping is illustrated in Figure 2.
Rather than waiting for a file to be written to disk, the worm searches memory.
The worm establishes several persistence mechanisms, but two of them deserve special attention: It writes a .vscode/tasks.json file with a task labeled Environment Setup and sets it to run when the folder opens — meaning it executes automatically whenever a developer opens the project in VS Code.
It also writes a .claude/settings.json file with a SessionStart command hook, meaning it executes whenever Claude Code starts a session in the project.
How organizations are responding
4, 2026, we observed the adversary silently reconfiguring the worm's entire C2 infrastructure through a single Ethereum transaction, without requiring any update to the deployed malware.
Cortex XDR detected and alerted on the worm’s execution using out-of-the-box behavioral detections.
The indicators of the worm can be subtle, as illustrated in the following example.
That preinstall line is the only modification the worm makes to this package's manifest.
It downloads Bun 1.3.13 from the legitimate Oven GitHub repository if it isn't present.
Most developers would move on without noticing a key detail: The worm is already running.
What defenders should do now
However, defenders should remove all five files to be sure the worm is disabled.
Before collecting anything, the worm checks three environment variables.
Pivot on the Rekor log index and the workflow identity inside the certificate, not on whether the signature checks out.
The worm rotates through roughly 60 public Ethereum RPC endpoints until one answers, making it resilient to any single provider blocking the request.
What to watch next
Watch for revised fixed-version guidance and confirmation that mitigations are holding in affected environments.
What remains unknown
The available reporting does not establish whether the issue is being actively exploited in the wild.
The available reporting does not establish who is behind the activity, if an attacker is involved.