Full Report
Shai-Hulud variant poisons 444 packages, spreads via tarballs and dev-tool hooks
Analysis Summary
# Tool/Technique: Shai-Hulud (Variant: ChainDrop)
## Overview
ChainDrop is a sophisticated self-propagating npm worm and a variant of the "Shai-Hulud" malware family. It is designed to conduct supply chain attacks by poisoning npm packages and spreading through developer environments. Unlike traditional supply chain attacks that modify source code repositories, ChainDrop targets the package distribution layer (tarballs) and developer tool configurations to maintain persistence and replicate across the ecosystem.
## Technical Details
- **Type:** Malware family (Worm / Supply Chain Attack)
- **Platform:** Cross-platform (Node.js/npm environments, GitHub, VS Code, Claude Code)
- **Capabilities:** Credential harvesting, self-replication, automated package poisoning, and configuration hijacking.
- **First Seen:** September 2025 (Shai-Hulud); August 2026 (ChainDrop variant).
## MITRE ATT&CK Mapping
- **[TA0001 - Initial Access]**
- [T1195.001 - Supply Chain Compromise: Compromise Software Dependencies]
- **[TA0003 - Persistence]**
- [T1546.012 - Event Triggered Execution: Native API]
- [T1554 - Compromise Client Software Binary (via Tarball manipulation)]
- **[TA0006 - Credential Access]**
- [T1552.001 - Unsecured Credentials: Credentials in Files]
- [T1555 - Credentials from Web Browsers/Password Stores]
- **[TA0007 - Discovery]**
- [T1083 - File and Directory Discovery]
- **[TA0011 - Command and Control]**
- [T1071.001 - Application Layer Protocol: Web Protocols]
## Functionality
### Core Capabilities
- **Tarball Poisoning:** The worm downloads existing npm package tarballs, injects its malicious payload, and re-uploads them. This bypasses source code audits as the repository itself remains "clean."
- **Credential Harvesting:** Scours workspaces, shell configurations (`.bashrc`, `.zshrc`), environment variables, and live memory for npm write tokens, cloud provider keys, and GitHub credentials.
- **Data Exfiltration:** Harvested secrets are encrypted and sent to attacker-controlled C2 endpoints.
### Advanced Features
- **Developer Tool Hooking:** Automatically executes when a developer opens a compromised branch in VS Code or Claude Code by leveraging `.vscode/tasks.json` or `.claude/settings.json`.
- **Automated Branch Infection:** Uses stolen GitHub credentials to query APIs and commit malicious configuration files to all accessible branches of a repository.
- **CI/CD Integration:** Exploits automated pipelines that pull patch updates, allowing the worm to move from developer machines into production build environments.
## Indicators of Compromise
- **File Names:**
- `.claude/settings.json` (unauthorized modifications)
- `.vscode/tasks.json` (unauthorized background tasks)
- **Network Indicators:**
- Exfiltration endpoints (Note: Specific C2 domains should be identified via Microsoft/SafeDep advisory logs; ensure any identified domains are defanged, e.g., `attacker[.]com`).
- **Behavioral Indicators:**
- Unexpected `npm publish` actions.
- Background processes attempting to read shell history or global environment variables.
- Automated commits to multiple Git branches containing only configuration file changes.
## Associated Threat Actors
- Currently attributed to unidentified actors utilizing the "Shai-Hulud" malware framework.
## Detection Methods
- **Behavioral Detection:** Monitoring for unauthorized modifications to IDE configuration files (`.vscode` or `.claude` directories) within Git repositories.
- **Audit Logs:** Reviewing npm registry logs for package updates that do not have corresponding commits in the source version control system.
- **Scanning:** Using specialized supply chain security tools (like SafeDep) to verify the integrity of downloaded tarballs against known-good hashes.
## Mitigation Strategies
- **Treat Config as Code:** Treat IDE and repository configurations as executable content; audit `.json` files in the `.vscode` and `.claude` directories.
- **Token Hardening:** Use granular, short-lived tokens for npm and GitHub. Avoid storing "full-access" tokens in environment variables or shell configs.
- **Dependency Pinning:** Use lockfiles (`package-lock.json`) and consider using "Trusted Publishers" (GitHub Actions OIDC) to limit where package publishes can originate.
- **Branch Protection:** Implement branch protection rules that require signed commits and prevent automated scripts from pushing to sensitive branches without review.
## Related Tools/Techniques
- **Shai-Hulud:** The original 2025 npm worm.
- **Dependency Confusion:** A related technique where internal package names are registered on public registries.
- **Typosquatting:** Similar in distribution scale but different in the mechanism of infection.