# ChainDrop

Published articles for ChainDrop.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain

DevFeed: [Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain](<https://devfeed.tech/articles/connecting-the-dots-securing-the-overlooked-corners-of-the-software-development-lifecycle-sdlc-supply-chain-7758.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/sdlc-supply-chain/>)

Author: Yaron Avital

Published: 2026-08-21T23:00:21Z

Content type: article

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [sdlc](<https://devfeed.tech/topics/sdlc.md>), [Security](<https://devfeed.tech/topics/security.md>), [Application Security](<https://devfeed.tech/topics/application-security.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Bun](<https://devfeed.tech/topics/bun.md>), [Python](<https://devfeed.tech/topics/python.md>), [Claude Code](<https://devfeed.tech/topics/claude-code.md>), [vs-code](<https://devfeed.tech/topics/vs-code.md>), [Claude](<https://devfeed.tech/topics/claude.md>), [Ethereum](<https://devfeed.tech/topics/ethereum.md>)

Tags: [blockchain](<https://devfeed.tech/tags/blockchain.md>), [c2](<https://devfeed.tech/tags/c2.md>), [chaindrop](<https://devfeed.tech/tags/chaindrop.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [claude-code](<https://devfeed.tech/tags/claude-code.md>), [general](<https://devfeed.tech/tags/general.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [insights](<https://devfeed.tech/tags/insights.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [persistence](<https://devfeed.tech/tags/persistence.md>), [python](<https://devfeed.tech/tags/python.md>), [sdlc](<https://devfeed.tech/tags/sdlc.md>), [security](<https://devfeed.tech/tags/security.md>), [software-supply-chain-attack](<https://devfeed.tech/tags/software-supply-chain-attack.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [vs-code](<https://devfeed.tech/tags/vs-code.md>)

### AI overview

Unit 42 describes how software supply-chain attackers are targeting developer tools, CI/CD pipelines, accounts, packages, setup scripts and developer environments before software reaches production. It examines the ChainDrop npm worm, which used malicious preinstall hooks, a Bun runtime, an obfuscated payload, Python-based memory theft, stolen tokens and secrets, self-propagation, persistence in VS Code and Claude Code, and Ethereum-managed command-and-control infrastructure.

### Source excerpt

Attackers are targeting CI/CD pipelines and developer tools instead of application code, requiring total SDLC visibility and strict security controls The post Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain appeared first on Unit 42.

## ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough

DevFeed: [ChainDrop npm Worm: Why SLSA Provenance Wasn't Enough](<https://devfeed.tech/articles/chaindrop-npm-worm-why-slsa-provenance-wasn-t-enough-13377.md>)

Original publisher: [Read original article](<https://www.harness.io/blog/chaindrop-npm-worm-valid-provenance>)

Author: Harness Team

Published: 2026-08-10T00:00:00Z

Content type: article

Language: en

Sources: [Harness Blog](<https://devfeed.tech/sources/harness-blog.md>)

Topics: [ChainDrop](<https://devfeed.tech/topics/chaindrop.md>), [npm](<https://devfeed.tech/topics/npm.md>), [supply-chain-security](<https://devfeed.tech/topics/supply-chain-security.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [GitHub](<https://devfeed.tech/topics/github.md>)

Tags: [chaindrop](<https://devfeed.tech/tags/chaindrop.md>), [ci](<https://devfeed.tech/tags/ci.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [integrity](<https://devfeed.tech/tags/integrity.md>), [least-privilege](<https://devfeed.tech/tags/least-privilege.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm](<https://devfeed.tech/tags/npm.md>), [npm-worm](<https://devfeed.tech/tags/npm-worm.md>), [openid-connect](<https://devfeed.tech/tags/openid-connect.md>), [provenance](<https://devfeed.tech/tags/provenance.md>), [security](<https://devfeed.tech/tags/security.md>), [slsa](<https://devfeed.tech/tags/slsa.md>), [software-supply-chain-security](<https://devfeed.tech/tags/software-supply-chain-security.md>), [worm](<https://devfeed.tech/tags/worm.md>)

### AI overview

The ChainDrop npm worm compromised hundreds of packages while retaining valid SLSA provenance, demonstrating that build attestations do not guarantee source integrity. The article explains the worm's propagation, credential theft, persistence mechanisms, and recommended defenses, including source governance, dependency controls, least-privilege identities, policy gates, and runtime evidence.

### Source excerpt

ChainDrop poisoned hundreds of npm packages while retaining valid provenance. Learn why signed builds need source governance, policy gates, and runtime evidence | Blog

## ChainDrop: Inside a Self-Propagating npm Worm

DevFeed: [ChainDrop: Inside a Self-Propagating npm Worm](<https://devfeed.tech/articles/chaindrop-inside-a-self-propagating-npm-worm-7748.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/>)

Author: Unit 42

Published: 2026-08-06T22:26:39Z

Content type: article

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [ChainDrop](<https://devfeed.tech/topics/chaindrop.md>), [npm](<https://devfeed.tech/topics/npm.md>), [Malware](<https://devfeed.tech/topics/malware.md>), [C2](<https://devfeed.tech/topics/c2.md>), [Ethereum](<https://devfeed.tech/topics/ethereum.md>), [GitHub Actions](<https://devfeed.tech/topics/github-actions.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [CI/CD](<https://devfeed.tech/topics/cicd.md>), [Security](<https://devfeed.tech/topics/security.md>)

Tags: [blockchain](<https://devfeed.tech/tags/blockchain.md>), [c2](<https://devfeed.tech/tags/c2.md>), [chaindrop](<https://devfeed.tech/tags/chaindrop.md>), [ci](<https://devfeed.tech/tags/ci.md>), [claude-code](<https://devfeed.tech/tags/claude-code.md>), [developer-tooling](<https://devfeed.tech/tags/developer-tooling.md>), [ethereum](<https://devfeed.tech/tags/ethereum.md>), [github](<https://devfeed.tech/tags/github.md>), [github-actions](<https://devfeed.tech/tags/github-actions.md>), [high-profile-threats](<https://devfeed.tech/tags/high-profile-threats.md>), [infrastructure](<https://devfeed.tech/tags/infrastructure.md>), [malware](<https://devfeed.tech/tags/malware.md>), [security](<https://devfeed.tech/tags/security.md>), [ssh](<https://devfeed.tech/tags/ssh.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [tokens](<https://devfeed.tech/tags/tokens.md>)

### AI overview

This article analyzes ChainDrop, a self-propagating npm worm that infected more than 400 packages and threatened developer workstations, CI pipelines, cloud environments and downstream users. It describes credential and token theft, GitHub Actions runner memory extraction, package republishing, persistence through developer and AI coding tools, blockchain-based C2 resolution, and C2 reconfiguration through an Ethereum transaction.

### Source excerpt

Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2 routing. The post ChainDrop: Inside a Self-Propagating npm Worm appeared first on Unit 42.

## 'ChainDrop' worm compromises hundreds of popular npm packages

DevFeed: ['ChainDrop' worm compromises hundreds of popular npm packages](<https://devfeed.tech/articles/chaindrop-worm-compromises-hundreds-of-popular-npm-packages-8296.md>)

Original publisher: [Read original article](<https://securitylabs.datadoghq.com/articles/npm-worm-compromises-popular-npm-packages/>)

Author: Christophe Tafani-Dereeper, Nick Frichette, Sebastian Obregoso, Martin McCloskey

Published: 2026-08-04T00:00:00Z

Content type: article

Language: en

Sources: [Datadog Security Labs](<https://devfeed.tech/sources/datadog-security-labs.md>)

Topics: [backdoor](<https://devfeed.tech/topics/backdoor.md>), [releases](<https://devfeed.tech/topics/releases.md>)

Tags: [backdoor](<https://devfeed.tech/tags/backdoor.md>), [chaindrop](<https://devfeed.tech/tags/chaindrop.md>), [github](<https://devfeed.tech/tags/github.md>), [malware](<https://devfeed.tech/tags/malware.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>)

### AI overview

ChainDrop is an npm worm that spread a backdoor through hundreds of compromised packages. The article analyzes its loader, which downloads or invokes Bun to run a second-stage payload.

### Source excerpt

On August 4, 2026, several popular npm packages, including 'keyv', were compromised to deliver malware.