GoKawiilSelf-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly downloads on the Node Package Manager (npm) registry.
Infected packages include very popular ones such as Keyv and Cacheable, flat-cache and file-entry-cache, all caching utilities from the same maintainer.
The supply-chain attack started after the threat actor compromised the GitHub account of Keyv’s maintainer, and quickly spread to packages associated with major organizations such as Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan.
Multiple application security companies spotted the attack and discovered that it deployed a Shai-Hulud-based worm named ChainDrop.
A report from Aikido says "at least 868 packages (across 1381 versions) have been compromised by the worm."
The researchers say that the attacker pushed malicious files directly to the projects’ main branches and then generated new package releases.
Because the packages were built and published through their legitimate GitHub Actions workflows, the compromised npm releases carried valid provenance information.
The poisoned packages contain two files: the setup.mjs payload dropper and the Math_Symbol.js script for stealing sensitive information, as well as a "preinstall": "node setup.mjs" entry in their package.json configuration file.
"Anyone who ran npm install against an affected version would have had setup.mjs execute automatically before their install completed," Aikido researchers warn.
The setup.mjs dropper downloads the Bun JavaScript runtime from the official GitHub release to execute Math_Symbol.js, the malicious payload with infostealing capabilities.
... continue reading