Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack

A sophisticated supply chain attack, dubbed ChainDrop, has infected over 2,200 malicious versions of 440 NPM packages, resulting in over 500 million weekly downloads. The attack began with a compromised GitHub account and involved a malware stealer that exfiltrates credentials to various services, including NPM, GitHub, AWS, and HashiCorp Vault. The malware uses a blockchain for command and control and includes a host-level dead-man’s switch to ensure persistence and self-deletion.