A credential-stealing worm hidden inside more than 400 npm packages has been spreading on its own, stealing developers' publishing tokens and using them to push poisoned updates to every other package those accounts control. Microsoft Threat Intelligence, which calls the campaign ChainDrop, published a full breakdown of the attack on August 4.
The affected packages span multiple unrelated publishers and include names that sit deep inside enterprise JavaScript stacks: keyv, flat-cache, cache-manager and others. IntelFusions covered the first wave of this hijack on August 4, when 42 poisoned versions were known. Microsoft's count is an order of magnitude larger.
What's affected
The malicious releases arrived as ordinary patch-version bumps, and many had no matching source commit, pull request, tag or legitimate release, which indicates the attackers modified and published package archives directly rather than compromising each project's public repository. That is also why nobody watching those repositories saw anything.
Each poisoned version adds an npm preinstall lifecycle script, meaning the code runs as soon as a developer or a build server starts installing the package, before application tests or conventional security checks get a look at it. The payload is a large, heavily obfuscated JavaScript bundle built for the Bun runtime, which Microsoft identifies as a variant of the Mini Shai-Hulud worm, a family we last wrote about when it started dodging AI-assisted scanners. Anyone whose workstation or build runner installed an affected package with lifecycle scripts enabled should treat that machine as potentially compromised.
What it steals
Once running, the malware works out whether it is on a developer's laptop or inside a continuous integration pipeline. On a workstation it detaches into the background so it survives the end of the install. In CI it stays attached to the running job so it can reach workflow secrets, runner credentials and OpenID Connect publishing permissions. It then sweeps credential files, shell histories, cloud configuration and SSH keys, captures every environment variable, and grabs the GitHub CLI token.
What sets it apart from a routine secret scraper is that it does not stop at finding tokens. It uses them, authenticating to npm, GitHub, Amazon Web Services, Kubernetes and HashiCorp Vault to verify the access works and to retrieve further secrets those identities are permitted to see. Results are compressed, encrypted with AES-256-GCM under a key wrapped with the attacker's RSA public key, and sent to an attacker-controlled HTTPS endpoint. That address is not fixed: the payload resolves it from an on-chain contract, with a cryptographically signed GitHub commit as fallback. If neither channel is available it creates a public GitHub repository, described as "Shai-Hulud: Here We Go Again", and commits the encrypted results there.
How it spreads itself
The propagation routine is simple and effective. Any stolen npm token is checked for package-write permission and for the ability to bypass two-factor authentication. If it passes, the malware downloads the latest release of each package that identity can publish, copies itself in, adds the loader, replaces the lifecycle scripts, increments the patch version and republishes. One stolen token becomes malicious releases across a publisher's entire portfolio, which is how the campaign reached this size so quickly.
Microsoft also found a targeted path through GitHub Actions workflows configured as npm trusted publishers. Packages published that way can carry valid provenance, because the release genuinely originates from a legitimate workflow identity.
It hides in your editor too
Using stolen GitHub credentials, the payload writes itself into repository branches at .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json and .vscode/setup.mjs. Those are configuration paths that Claude and Visual Studio Code read, so ordinary editor activity can restart the payload long after the original npm install finished, and can carry it to the next developer who works on the repository.
What you should do
Microsoft's guidance is to update the npm CLI to v11.10.0 or later and use its min-release-age feature, review dependency trees, lockfiles, artifact repositories and CI caches for compromised versions including transitive references, and pin known-good versions. Purge npm and yarn caches on affected developer endpoints and build hosts, especially where poisoned archives may have been written into a shared CI cache. If a build system or workstation imported a compromised version, rotate credentials and secrets from a clean host, then rebuild affected projects from a known-good dependency baseline. Organisations that share base images or golden build runners should rebuild those as well, so future jobs do not inherit a poisoned cache. The analysis, by Microsoft Security Research with Ravikant Tiwari, Sagar Patil and Suriyaraj Natarajan, carries hunting queries and the full indicator set in the original report.
Indicators
Command and control domains, defanged: npm-cache[.]com, which the on-chain contract returned at the time of analysis, plus earlier candidates pypi-get[.]com and js-mirror[.]com. The routing URL is hxxps://npm-cache[.]com:443/router. Two hashes worth hunting are 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668, the npm archive preinstall loader, and fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1eb, the loader dropped into .claude and .vscode. Also review Node.js directories for leftover files named Math_Symbol.js, Math_init.js or math_ followed by a GUID.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.