ChainDrop NPM Worm Analysis

ChainDrop (also referred to as Shai‑Hulud) is a supply‑chain worm that leverages compromised npm maintainers to publish packages containing setup.mjs and an obfuscated Math_Symbol.js executed via the Bun runtime. The dropper collects a wide range of credentials (npm, GitHub, cloud provider, SSH, API keys), automatically repackages and republishes poisoned npm packages using stolen tokens to propagate across organizations, exfiltrates encrypted data to attacker‑controlled GitHub repositories or an Ethereum C2 fallback, and maintains persistence through IDE/AI tooling hooks and a background token monitor that can trigger destructive actions if tokens are revoked.