Npm Supply Chain Attack: ChainDrop Worm Compromises Packages
- Severity
- HIGH
- Affected component
- npm packages (npm)
- Patched version
- Not yet available
A self-propagating worm has published compromised versions of dozens of npm packages using stolen maintainer credentials. Check the list of affected packages and update to the latest secure versions.
What happened
A self-propagating worm has compromised dozens of npm packages using stolen maintainer credentials. The worm, known as ChainDrop, has published malicious versions of popular packages in the keyv and Cacheable namespaces. These compromised packages have been downloaded by unsuspecting developers, potentially leading to the execution of malicious code on their systems.
The attack leverages lifecycle hooks like preinstall or postinstall to trigger the execution of malicious code. In some cases, the packages come with a README that instructs developers to load them with require(), a built-in function to import modules, local files, and third-party packages. This leads to the execution of a downloader that fetches a compatible payload from one of several Cloudflare Workers hosts.
The payloads vary depending on the host operating system and processor architecture. For example, Linux x64 systems receive a payload from sdk.dl.wel1[.]ru, while Windows systems receive a payload from net.dl.wel1[.]ru. If the HTTPS-based downloads fail, the malware switches to a platform-specific domain and uses DNS TXT records to obtain the next-stage from the domain wel1[.]ru.
What to do about it
- Check the list of affected packages and update to the latest secure versions.
- Monitor your systems for any unusual activity or unauthorized access.
- Review your dependency management practices to ensure you are using trusted sources and verifying the integrity of packages before installation.
- No official fix has been published yet. Monitor the sources below for updates.
How 0Day would have caught this
npm packages is anywhere in your dependency tree, the engineers who own the affected repositories get a push alert the moment it is flagged — no manual audit to remember to run.Read how this differs from waiting on a scanner to catch a known advisory, or see the exact, read-only access 0Day needs to do this for an organization.
Frequently asked questions
Am I affected?
If you are using any of the compromised npm packages, you may be affected. Check the list of affected packages and update to the latest secure versions.
What should I do right now?
Check the list of affected packages and update to the latest secure versions. Monitor your systems for any unusual activity or unauthorized access.
How did this attack happen?
The attack leveraged stolen maintainer credentials to publish compromised versions of popular npm packages. The malicious packages used lifecycle hooks to execute malicious code upon installation.
What are the potential impacts of this attack?
The potential impacts include unauthorized access to systems, data theft, and the execution of malicious code on affected systems.
Sources
- Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
- Nearly 800 Malicious npm Packages Deliver Cross-Platform RAT and Infostealer
- Trojanized npm Packages Decode C2 IP From Ethereum Recipient Addresses
- Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages
- ChainDrop supply chain compromise: Anatomy of a self-propagating worm
- Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack
- Six npm Packages Use Ethereum Transactions to Retrieve Malicious Payloads
- ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2