A massive supply chain attack on the Node Package Manager (npm) registry has infected over 400 packages with over 2 billion downloads with the self-propagating malware ChainDrop, a new variant of the Shai-Hulud worm, Microsoft Threat Intelligence says.
“The malware typically executes automatically through an npm preinstall lifecycle hook before package installation completes,” the tech giant explained.
Belgian cybersecurity firm Aikido also tracked the campaign and assessed that at least 868 packages, spanning over 1380 versions, have been affected.
The campaign began on August 4, 2026, when an attacker compromised a keyv and cacheable maintainer’s account before pivoting to other organizations’ repositories, including Deliveroo, OneReach, Ornikar, Picsart, ServiceTitan, and Qlik.
Supply chain attack affected popular npm packages with over 2 billion downloads
The supply chain attack affected popular packages, including enterprise repositories such as keyv (29 M monthly downloads), cacheable (29 M), flat-cache (565 M), cache-manager, and file-entry-cache (557 M), posing serious security risks to millions of downstream customers.
According to the Redmond, Washington-based tech colossus, the malware targets developer workstations and continuous integration and continuous delivery (CI/CD) environments for npm, GitHub, cloud, and infrastructure credentials. It collects secrets from compromised environments, encrypts them, and sends them to attacker-controlled domains and a public GitHub repository as a fallback, with the description “Shai-Hulud: Here We Go Again.”
Using the stolen credentials, the malware authenticates on npm, GitHub, AWS, Kubernetes, and HashiCorp Vault, enumerates repositories, inserts malicious code, adds a setup loader and a preinstall hook, increments the version, and republishes the package. Consequently, the new releases appear legitimate as they are published via legitimate GitHub Actions workflows.
“The compromise was carried out by pushing malicious files directly to the main branch and then immediately cutting a new release, meaning the poisoned versions were published to npm with valid provenance signed by GitHub Actions,” Aikido stated.
Developers execute malware before ‘npm install’ completes
Microsoft says the infected packages contain two files in their package.json file: setup.mjs, the main payload dropper, and Math_Symbol.js, which has credential-stealing abilities. Setup.mjs executes Math_Symbol.js using the official Bun JavaScript runtime, which it downloads from GitHub. After successfully running the infostealer, the payload dropper deletes the temporary runtime directory to cover its tracks.
According to Aikido Security, any developer who executes ‘npm install’ automatically executes the setup.mjs payload dropper before the installation completes. Additionally, the malware’s self-propagating capabilities allow it to infect other packages besides the one initially poisoned, resulting in a wider supply chain attack.
The malware scours the infected development and CI/CD environments for credentials it could exploit to infect other npm packages. Highly sought-after secrets include private keys, database credentials, AWS keys, GitHub action secrets, Kubernetes secrets, npm tokens, HashiCorp Vault tokens and KV secrets, and the complete process environment.
“The malware can also use stolen GitHub credentials to inject Claude and Visual Studio Code configuration files into repositories, establishing persistence and creating an additional developer-to-developer infection path,” Microsoft warned.
Thus, removing the infected package does not guarantee total remediation due to the malware’s self-propagating nature. Consequently, any developer who installed an infected package should consider their development and CI/CD environments compromised. They should start by removing poisoned packages, rebuilding their repos from safe backups or recreating them from scratch, and rotating or revoking secrets associated with the affected repositories and their development environments.
They should also watch out for suspicious commits and monitor access logs for malicious behavior associated with the supply chain attack.
“What threat actors collected from each infected system is where the real risk compounds,” said Max Gannon, Cyber Intelligence Team Manager at Cofense. “We have consistently observed that stolen developer tokens, cloud access keys, and API credentials do not sit idle. They get used to access additional environments, fuel follow-on phishing campaigns, and in many cases get sold to other threat actors who specialize in converting initial access into ransomware or business email compromise.”
Another npm supply chain attack
Cybercriminals have frequently targeted npm to launch supply chain attacks affecting hundreds of packages and millions of customers.
In June 2026, the Megalodon supply chain campaign, linked to TeamPCP, the group behind the Shai-Hulud worm, infected over 5,500 GitHub repositories with backdoors and credential stealing malware within 6 hours.
A similar campaign in December 2025 by North Korean hackers deployed more than 200 malicious npm packages during the second phase of the Contagious Interview campaign, following an earlier campaign that poisoned 338 packages.
