Date: 08/06/2026
Severity: High
Summary
ChainDrop is a large-scale npm supply chain compromise that leveraged compromised maintainer accounts to infect over 1,300 npm packages with a self-propagating worm, enabling rapid spread across developer environments and CI/CD pipelines. The malware steals GitHub tokens, cloud credentials, API keys, and other secrets, then uses the harvested credentials to automatically compromise additional packages, creating a worm-like propagation mechanism. The campaign highlights the growing sophistication of software supply chain attacks, emphasizing the need for strong credential protection, package integrity verification, and continuous monitoring of developer ecosystems.
Indicators of Compromise (IOC) List
IP Address | npm-cache.com pypi-get.com js-mirror.com https://npm-cache.com:443/router |
Hash | 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668
fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb
9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc
|
Gurucul Threat Detection and Incident Response (TDIR) Queries for Detection
Detection Query 1 : | domainname like "npm-cache.com" or url like "npm-cache.com" or siteurl like "npm-cache.com" or domainname like "pypi-get.com" or url like "pypi-get.com" or siteurl like "pypi-get.com" or domainname like "js-mirror.com" or url like "js-mirror.com" or siteurl like "js-mirror.com" or domainname like "https://npm-cache.com:443/router" or url like "https://npm-cache.com:443/router" or siteurl like "https://npm-cache.com:443/router" |
Detection Query 2 : | sha256hash IN ("54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668","9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bcc","fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb")
|
Reference:
https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/