ChainDrop: Inside a Self-Propagating npm Worm

A self‑propagating npm worm called ChainDrop (linked to the Shai‑Hulud code lineage) infected hundreds of packages and actively stole developer and cloud credentials, CI secrets (including in‑memory GitHub Actions tokens), SSH keys and other sensitive artifacts, republishing infected packages to spread; it uses an Ethereum smart contract to rotate C2 domains, supports targeted remote code execution, and has been observed across multiple environments with hundreds of public repositories exhibiting exfiltration indicators—Unit 42 provides IoCs, detection guidance, and remediation steps.