A large supply chain attack has hit the NPM package registry, with more than 2,200 malicious versions of 440 packages published after attackers compromised a developer's GitHub account.
The attack, called ChainDrop, began after hackers infected the keyv and cacheable packages that have more than 500 million weekly downloads. The attack quickly spread, infecting 433 more packages.
The malicious packages ran malware during installation. The malware stole sensitive information, including NPM, GitHub, cloud, and infrastructure credentials. It also used stolen NPM and GitHub accounts to publish infected package updates and spread to more repositories.
Researchers found that the malware could upload stolen data to attacker-controlled GitHub repositories or remote servers. It also modified package versions by adding a malicious preinstall script before republishing them.
The malware used the Ethereum blockchain as part of its command-and-control system. It could also stay active on infected macOS and Linux systems while checking if stolen GitHub tokens were still valid.
Security researchers say anyone who installed the affected package versions should treat their system as compromised. They recommend removing the malware, rebuilding CI/CD systems, rotating all potentially exposed credentials, and checking GitHub repositories for suspicious activity.