Microsoft Threat Intelligence has identified a large-scale npm supply chain attack affecting more than 400 packages across multiple unrelated publishers, with a self-propagating worm stealing credentials from developer environments. The attack, which Microsoft researchers dubbed ChainDrop in an August 4 security blog post, involves a malware variant called Mini Shai-Hulud that executes via npm preinstall hooks and automatically spreads to other packages maintained by compromised developers. The discovery marks one of the largest supply chain compromises in the npm ecosystem’s history.
How the Worm Propagates
The malicious code is delivered through heavily obfuscated Bun-based JavaScript payloads that execute automatically via npm preinstall lifecycle hooks before package installation completes. Once a developer’s environment is compromised, the worm harvests approximately 40 categories of secrets through regex pattern matching, including cloud provider credentials, AI platform API keys from OpenAI, Anthropic, and Cohere, CI/CD tokens, SSH keys, cryptocurrency wallet data, and browser-stored passwords. The stolen data is exfiltrated to attacker-controlled servers through a dual-channel endpoint designed to resist censorship and takedown attempts.
What makes this attack particularly dangerous is its self-propagating nature. The worm uses compromised developer credentials to publish new versions of other packages that the same account maintains, injecting its own malicious code into the supply chain without any further attacker involvement. This turns a single point of compromise into an automatic cascade across the developer’s entire package portfolio. Aikido Security identified over 400 infected packages, while Wiz reported more than 25,000 affected repositories, with the infection rate accelerating to approximately 1,000 new repositories every 30 minutes at its peak.
A Pattern of Escalating npm Attacks
The ChainDrop campaign follows a series of escalating npm supply chain attacks throughout 2026. In mid-March, a threat actor tracked as TeamPCP compromised Trivy, the widely deployed open-source security scanner, by leveraging stolen maintainer credentials to deploy the CanisterWorm variant across 29 packages. In April, the CanisterSprawl campaign, identified by Socket and StepSecurity, spread through at least 16 malicious package versions spanning publisher namespaces linked to Namastex Labs. By May, the Mini Shai-Hulud variant had compromised over 160 packages including those associated with TanStack, Mistral AI, and UiPath, with Microsoft’s analysis confirming the scope had grown to 400-plus packages by August. Each iteration of the attack has grown more sophisticated, combining autonomous self-replication with credential harvesting and, in some cases, built-in wiper functionality that destroys evidence of the compromise.
Scope of Compromise
The compromised packages include keyv, flat-cache, and cache-manager, which are foundational libraries used across enterprise JavaScript ecosystems. These are not obscure packages but core dependencies installed by thousands of organizations. The attack exploits the fundamental trust model of open-source package repositories, where developers routinely install dependencies without full visibility into the supply chain. The fact that the worm can automatically propagate to every package maintained by a compromised developer account means that a single breach can infect dozens or hundreds of downstream projects in minutes.
Implications for Enterprise Security
The attack vector targets the CI/CD pipeline itself rather than end-user systems. Organizations that installed an affected package with lifecycle scripts enabled should treat the associated developer workstation or build runner as potentially compromised. Microsoft recommends prioritizing investigations into credentials accessible to the affected identity, unauthorized npm releases, unexpected repository or workflow modifications, suspicious cloud and secret-store access, and artifacts produced by affected build systems.
The stolen credentials, which include cloud access keys, API tokens, SSH keys, and container registry passwords, are exactly the type of data that enables lateral movement within enterprise infrastructure. The attack underscores a fundamental challenge in open-source security: packages with millions of weekly downloads can be compromised through a single compromised maintainer account, and the resulting worm can spread to other packages before anyone detects the compromise. Security researchers have emphasized that the traditional model of reviewing individual package code is no longer sufficient when self-propagating worms can automatically re-infect an entire publisher’s portfolio.
Microsoft Defender XDR customers can detect the compromise through specific detections including Trojan:NPM/ShaiLoader.BY and Trojan:NPM/ShaiWorm.DAY!MTB. Organizations should audit their npm dependencies and ensure that preinstall lifecycle hooks are disabled or restricted in CI/CD environments, as these hooks are the primary execution mechanism for the worm. Rapidly rotating potentially exposed credentials and monitoring for unauthorized npm releases are also recommended as immediate containment measures.
discussion