ChainDrop: Inside a Self-Propagating npm Worm

A self-propagating npm worm, nicknamed ChainDrop, has infected over 400 packages, collectively downloaded hundreds of millions of times weekly. Developed by a threat actor, the worm steals sensitive data including cloud credentials, npm and GitHub tokens, SSH keys, and AI-tool configurations. It achieves this by leveraging legitimate tools like VS Code and GitHub Actions to establish persistence and exfiltrate data through various channels, including typosquatted repositories and GitHub Actions artifacts. The attackers use a silent propagation method to avoid detection, only activating when specific environment variables are set. Unit 42 has identified and removed the malicious packages and continues to offer assistance to organizations impacted by the attack.