ChainDrop Inside a Self-Propagating npm Worm

[carlospolop]

🤖 Automated Content Update

This PR was automatically generated by the HackTricks News Bot based on a technical blog post.

📝 Source Information

• Blog URL: https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis
• Blog Title: ChainDrop: Inside a Self-Propagating npm Worm
• Suggested Section: Pentesting CI/CD > Github Security > Abusing Github Actions > npm Supply Chain Abuse; add subsections for npm lifecycle-hook worms, runner process-memory secret theft, OIDC trusted-publishing abuse, malicious-workflow provenance, and credential-driven package propagation

🎯 Content Summary

Overview and severity

ChainDrop is a critical, self-propagating npm supply-chain worm from the Shai-Hulud code lineage. It infected over 400 packages collectively downloaded hundreds of millions of times per week, including malicious versions of keyv and cacheable-request. Unit 42 detected execution in 10 distinct environments and identified 453 public GitHub repositories across five candidate victim accounts that matched the worm's exfiltration pattern; the ...

🔧 Technical Details

Lifecycle-hook supply-chain execution: An npm package can retain all legitimate functionality while adding a small dropper, an obfuscated payload and "preinstall": "node setup.mjs". npm executes the dropper automatically during installation. The dropper can download or reuse a legitimate portable runtime such as Bun, detach the malicious process outside CI and set an environment marker such as _NODE_RUNTIME_INIT=1 to prevent recursive relaunch.

Environment-aware execution: Malware can alter execution depending on whether it detects CI. Detaching on workstations hides execution and lets installation complete normally, while inline execution in CI inherits access to workflow credentials but may expose debugging output in job logs. Locale checks can selectively exclude systems in chosen regions.

CI process-memory credential theft: Malware on a Linux runner can locate a privilege...

🤖 Agent Actions

Updated:

• src/pentesting-ci-cd/github-security/abusing-github-actions/gh-actions-npm-supply-chain-abuse.md

Added concise, cited coverage for:

• npm lifecycle-hook worms that preserve legitimate package behavior
• GitHub Actions runner process-memory secret theft via /proc/<pid>/maps and /proc/<pid>/mem
• workflow/artifact-based secret exfiltration with ${{ toJSON(secrets) }}
• OIDC trusted-publishing abuse
• typosquatted dependency injection without lifecycle scripts
• provenance limits when a legitimate release workflow is compromised
• credential-driven wormable npm propagation

Also fixed that page’s ## References section to numbered format and added inline citation superscripts.

---

This PR was automatically created by the HackTricks Feed Bot. Please review the changes carefully before merging.

[carlospolop]

🔗 Additional Context

Original Blog Post: https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis

Content Categories: Based on the analysis, this content was categorized under "Pentesting CI/CD > Github Security > Abusing Github Actions > npm Supply Chain Abuse; add subsections for npm lifecycle-hook worms, runner process-memory secret theft, OIDC trusted-publishing abuse, malicious-workflow provenance, and credential-driven package propagation".

Repository Maintenance:

• MD Files Formatting: 590 files processed

Review Notes:

• This content was automatically processed and may require human review for accuracy
• Check that the placement within the repository structure is appropriate
• Verify that all technical details are correct and up-to-date
• All .md files have been checked for proper formatting (headers, includes, etc.)

Bot Version: HackTricks News Bot v1.0