ChainDrop worm poisoned 444 npm packages in four hours

A self-propagating npm worm that researchers named ChainDrop spread through the registry on August 4, 2026, poisoning 444 package names across 2,212 versions in under four hours and touching more than a dozen victim organizations, among them ServiceTitan, Ornikar, Qlik, and nebula.js.

It started with one maintainer. The operator took over the GitHub account behind the keyv and cacheable package families, committed a preinstall hook to the main branch, and cut releases through the project's own GitHub Actions workflow, which meant the poisoned versions carried valid provenance. From there the worm used what it stole. Every set of npm credentials it harvested became publishing rights for the next round of packages, and it minted fresh tokens through npm's OIDC trusted publishing where a workflow identity allowed it.

The payload was a credential harvester aimed squarely at build infrastructure: npm and GitHub tokens, cloud credentials, SSH keys, database connection strings, and secrets read directly out of GitHub Actions runner memory. It also wrote autostart hooks into .claude and .vscode directories, so a developer who merely opened affected source would run it.

The operational novelty was the command-and-control channel. Rather than hardcoding an exfiltration endpoint, ChainDrop queried an Ethereum smart contract at runtime to learn where to send its results, cycling through roughly 60 public RPC endpoints until one responded. Blocking any single provider accomplished nothing, and late on August 4 researchers watched the operator move the entire C2 infrastructure with one transaction, without shipping a malware update. StepSecurity matched the payload byte-for-byte against Shai-Hulud 2.0, the November 2025 worm, on markers including the Bun preinstall dropper and a verbatim memory-dump grep. Unit 42 agrees on the code lineage but says plainly that it cannot yet tell whether TeamPCP runs it or another group adapting the published toolkit.