THE article discusses a newly detected self-propagating npm worm named ChainDrop, which is linked to over 400 infected packages, downloaded extensively, and targets developer environments and cloud infrastructures. It can steal sensitive credentials, such as cloud tokens and SSH keys, and uses a unique delivery method via contaminated npm packages that include a preinstall lifecycle hook to execute malware.
The command and control infrastructure is based on Ethereum smart contracts, allowing operators to quickly change server addresses. The infection method involves minimal visible alterations to legitimate packages, making it hard for developers to notice. The worm has sophisticated persistence mechanisms and can republish itself using stolen npm tokens. Detection strategies are advised, including auditing package manifests and revoking compromised credentials.