Thought Leadership
A new supply chain attack is sweeping through the npm ecosystem. The malware, dubbed Chaindrop, belongs to the Shai-Hulud malware family, which has been on the radar of security researchers for some time.
According to security firm Aikido, the attack began with the compromise of a GitHub account belonging to a maintainer responsible for the widely used key-value storage library keyv. Because the developer also maintained several other popular packages, the attackers were able to inject malicious code across the entire package family. Collectively, these packages account for approximately 127 million downloads per week.
Aikido reports that 444 packages spanning 1,381 versions have now been affected. Together, they generate more than two billion downloads every month. Impacted projects include:
- keyv
- flat-cache 6.1.24
- file-entry-cache 11.1.6
- cacheable-request 13.0.20
- cacheable 2.5.1
- @cacheable/memory 2.2.1
- cache-manager 7.2.10
- @cacheable/node-cache 3.1.2
- @cacheable/utils 2.5.1
- @cacheable/net 2.1.1
- ecto 5.0.1
How the Malware Operates
According to Aikido, Chaindrop actively searches compromised systems for sensitive credentials. The stolen data is encrypted before being uploaded to a publicly accessible GitHub repository whose name references the Shai-Hulud malware family. The encryption is designed so that only the attackers can decrypt the data using their private RSA key. As a result, while the stolen credentials remain publicly visible, they are effectively unusable to anyone else.
Chaindrop also includes a self-propagation mechanism. If it discovers a valid npm token on an infected system, it queries the npm Registry API to determine which packages can be published using that token. The malware then downloads the latest versions of those packages, unpacks them, injects its malicious code, and republishes them. This allows Chaindrop to spread automatically into projects maintained by other developers once they have integrated an already compromised package into their software.
Among the credentials targeted by the malware are:
- npm tokens
- GitHub tokens
- AWS credentials
- Kubernetes secrets
- HashiCorp Vault tokens
- Stripe and Slack credentials
Shai-Hulud Has Been Causing Problems for Months
Chaindrop is far from the first incident involving the Shai-Hulud malware family. In May, the group behind Shai-Hulud, TeamPCP, publicly released the malware’s source code on GitHub. Although the repository was quickly removed, researchers at Datadog Security Labs believe numerous copies of the code continue to circulate. Their analysis concluded that the leaked source code represents a mature attack framework covering nearly all of the group’s known techniques.
In the months that followed, security researchers repeatedly identified new variants of the malware.
(lb)
