ChainDrop: A Self-Propagating npm Worm Hits 400+ Packages
ChainDrop is a self-propagating npm supply-chain worm that compromised more than 400 packages, including the widely used keyv and cacheable-request libraries, through a three-stage infection chain. The worm hooks into the package manifest, steals npm and GitHub tokens, then uses those credentials to silently backdoor and republish every other package the maintainer controls.
The propagation works by modifying the package.json manifest to inject a preinstall hook that runs on install. Once the hook executes, it sweeps the environment for npm and GitHub tokens, encrypts the harvested credentials with AES-256-GCM, and RSA-encrypts the AES key with the attacker’s hardcoded public key. The worm then republishes the co-owned packages with the malicious code embedded, leaving the original functionality intact so developers don’t notice the change.
For long-term persistence, ChainDrop installs cross-linked hooks directly into VS Code and Claude Code, giving it a foothold in the developer’s tooling. Command-and-control is managed dynamically through an Ethereum smart contract at 0xE1f2395ee43e45A1556EC6438a88c31B83493103, which the worm queries at runtime to fetch the current exfiltration endpoint. This lets the attacker rotate the C2 domain without redeploying the payload. If the contract lookup fails, the worm falls back to a GitHub commit history search for a signed marker, validating the C2 domain against an embedded RSA public key before accepting it.
How the Worm Works: From preinstall Hook to Ethereum C2
Execution is triggered through a preinstall hook injected into the package.json manifest. This abuses a standard npm lifecycle feature that runs arbitrary shell commands before the package is installed, requiring no further user interaction. Once the hook fires, it sweeps the environment for npm and GitHub tokens, encrypts the harvested credentials with a randomly generated AES-256-GCM key, and then RSA-encrypts that AES key with the attacker’s hardcoded public key. Only the attacker holding the corresponding private key can decrypt the exfiltrated data.
For command-and-control, ChainDrop does not hardcode a C2 domain. Instead, it queries an Ethereum smart contract at 0xE1f2395ee43e45A1556EC6438a88c31B83493103 at runtime to fetch the current exfiltration endpoint. The worm fans out across three RPC providers—eth.llamarpc.com, go.getblock.io, and eth-mainnet.nodereal.io—so a rate-limited or downed endpoint does not break resolution. This lets the attacker rotate the C2 domain without redeploying the payload.
If the contract lookup fails, the worm falls back to a GitHub commit history search for a cryptographically signed marker (thebeautifulmarchoftime), validating the C2 domain against an embedded RSA public key before accepting it. If both paths fail, it exfiltrates via a public GitHub repository based on Dune names, using the compromised victim’s account with the description: Shai-Hulud: Here We Go Again.
The C2 Trick: Ethereum Dead-Drop Resolver
Instead of hardcoding the C2 domain into the payload, ChainDrop queries an Ethereum smart contract at 0xE1f2395ee43e45A1556EC6438a88c31B83493103 via eth_call to fetch the current exfiltration endpoint at runtime. This lets the attacker rotate the C2 domain by updating the contract without redeploying the worm.
The worm fans out the eth_call request across three public RPC providers—eth.llamarpc.com, go.getblock.io, and eth-mainnet.nodereal.io—so a rate-limited or downed endpoint does not break resolution. At detonation, we observed two dead-drop domains: awqhnjewqjkl[.icu] and npm-cache[.com].
If the contract lookup fails, the worm falls back to a GitHub commit history search for a cryptographically signed marker (thebeautifulmarchoftime), validating the C2 domain against an embedded RSA public key before accepting it.
Who Was Hit: keyv and 1.3B Monthly Downloads
The compromise began when attackers seized the maintainer account for keyv, a key-value storage library that pulled over 600 million downloads last month. They trojanized the monorepo and embedded the CHAINDROP worm, which then used the stolen npm credentials to backdoor every other package the maintainer had publish rights to. The full set of co-owned packages totals 1.3 billion monthly downloads.
Elastic Security Labs identified the campaign on August 4, 2026, and confirmed 400+ unique npm packages compromised by the time of writing.
Why This Matters: The SDLC Supply-Chain Pattern
ChainDrop follows the same pattern that has defined the last 18 months of software supply-chain attacks: target the CI/CD pipeline or developer environment, hijack the code at the source, and let it propagate before it ever reaches production. XZ Utils, Axios, and Shai-Hulud all did this by backdooring a single package and hoping the maintainer publishes the rest. ChainDrop automates the whole thing.
The worm self-propagates by stealing the victim’s npm and GitHub tokens, then republishing every co-owned package with the payload embedded. That is what makes it a worm rather than a one-off backdoor — each infected package can infect the next, and the attacker does not need to manually push 400+ packages. Palo Alto Unit 42 groups it with the broader SDLC supply-chain trend and recommends signed commits at the developer endpoint, signed artifacts in CI/CD, and SBOMs in production to stop self-propagating worms in their tracks.
Key points
- ChainDrop is a self-propagating npm worm that infected 400+ packages including keyv (600M+ monthly downloads) and cacheable-request via a preinstall hook in package.json.
- The worm steals npm and GitHub tokens from the keyv maintainer, then uses them to auto-republish every co-owned package the maintainer has publish rights to.
- C2 is resolved at runtime via an Ethereum smart contract (0xE1f2395ee43e45A1556EC6438a88c31B83493103) queried across three RPC providers, with a GitHub commit-history fallback and a public Dune-named repo as last resort.
- Exfiltration is AES-256-GCM encrypted then RSA-encrypted with the attacker's hardcoded public key; only the attacker's private key can decrypt the data.
- Unit 42 ties ChainDrop to the XZ Utils, Axios, and Shai-Hulud npm worm patterns, positioning it as the next wave of self-propagating SDLC supply-chain attacks targeting CI/CD and developer environments.
Further reading & sources
- Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain — PaloAlto Networks Unit 42
- Shai-Hulud strikes again: CHAINDROP worm hits 400+ npm packages — Elastic Security Labs
- Blockchain Dead Drop Resolvers Explained - Netskope
- The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)
- ChainDrop supply chain compromise: Anatomy of a self-propagating worm | Microsoft Security Blog