ChainDrop Worm Infects Over 435 npm Packages in Record-Breaking Attack

A massive supply chain attack has been discovered on npm, one of the largest package managers for JavaScript developers. The worm, dubbed ChainDrop, infected over 435 packages and 1,557 versions across more than a dozen victim organizations in just two hours.

The attack began inside three GitHub repositories owned by Jared Wray, with the first poisoned commit pushed to jaredwray/keyv main at 09:02 UTC. The worm then republished itself into 424 additional packages (1,546 versions) using credentials harvested from earlier victims.

According to StepSecurity, the payload carries a preinstall dropper that downloads the legitimate Bun JavaScript runtime and a second stage that steals credentials, publishes more malicious packages, and burrows into AI developer tooling. The attack also uses an Ethereum blockchain C2 (EtherHiding) for encrypted exfiltration.

StepSecurity advises developers to check their lockfiles for any of the affected packages and versions, including transitive dependencies. If present, assume compromise: treat any machine or CI runner that installed these versions as compromised. Rotate all credentials, tokens, and secrets that were present in those environments and pin or roll back to a known good previous version.