Back to feed
Dev.to
Dev.to
8/5/2026
ChainDrop: A Supply Chain Worm Stealing Credentials and Self-Propagating via Legitimate Provenance-Signed npm Packages

ChainDrop: A Supply Chain Worm Stealing Credentials and Self-Propagating via Legitimate Provenance-Signed npm Packages

Short summary

ChainDrop is a critical supply chain worm that compromised 434 npm packages with 2B+ monthly downloads by hijacking maintainer GitHub accounts and publishing malicious versions through legitimate GitHub Actions with valid provenance. The worm steals credentials from GitHub, npm, AWS, Kubernetes, Vault, and other services, then self-propagates by republishing infected packages and injecting hooks into VS Code and Claude Code configurations.

  • •434 npm packages (2B+ monthly downloads) compromised via maintainer account takeover with valid provenance signatures
  • •Worm steals credentials from GitHub, npm, AWS, Kubernetes, Vault, Stripe, Slack and self-propagates to other packages
  • •Provenance signing alone cannot detect the attack; SOCs should watch for Bun downloads during npm install and mass secret scanning

Generated with AI, which can make mistakes.

#ai-tools#ai-agents#open-source
Read full article at Dev.to

Is this a good recommendation for you?

Comments

Failed to load comments. Please try again.

Explore more

Supply-chain attack on npm: 868+ packages compromised by self-propagating credential-stealing worm
Dev.to
The original headline is: "Shai-Hulud supply chain attack compromises Keyv and related npm packages"
Dev.to
Malicious 'jscrambler' NPM Package Versions Deploy Cross-Platform Infostealer in Sophisticated Supply Chain Attack
Dev.to
GTIG: 2026 OSS Supply Chain Compromise, Credential Theft, and Self-Propagation
Dev.to