SDLC Supply Chain Attacks: ChainDrop npm Worm and Developer Pipeline Targeting — Threadlinqs Intelligence
As of 2026-08-21, SDLC Supply Chain Attacks: ChainDrop npm Worm and Developer Pipeline Targeting is a high-severity threat intel threat attributed to Multiple unattributed actors (Multiple), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 28 indicators of compromise.
Threat ID: TL-2026-2104 · Severity: HIGH · Status: ACTIVE · Category: THREAT_INTEL
Attribution: Multiple unattributed actors · Multiple · ESPIONAGE
A broad, ongoing campaign targeting the software development lifecycle (SDLC) supply chain has escalated in 2025–2026, with the ChainDrop npm worm as the most technically sophisticated case study.
The software supply chain has become the most lucrative attack surface in modern cybersecurity. Open-source code composes 80-90% of modern codebases, and a single application today pulls in thousands of transitive dependencies across multiple ecosystems. Attackers have responded by shifting focus from finished applications to the development pipeline itself — CI/CD systems, developer workstations, package registries, IDE extensions, and the foundational OS libraries that everything depends on.
The ChainDrop npm worm, disclosed by Microsoft Threat Intelligence and Palo Alto Networks Unit 42 in August 2026, represents a watershed moment in supply chain attack sophistication. A self-propagating worm in the Mini Shai-Hulud lineage, ChainDrop infects packages through a three-step chain: (1) a malicious preinstall hook in package.json that executes a 727KB obfuscated Bun-based JavaScript payload, (2) credential theft spanning developer workstations and CI/CD runners (including live process-memory scraping of GitHub Actions OIDC tokens), and (3) automated propagation — the worm republishes infected packages using stolen npm tokens, incrementing only the patch version. The worm uses an Ethereum smart contract (StringListStore at address 0xE1f2395ee43e45A1556EC6438a88c31B83493103) for dynamic C2 domain resolution with no hardcoded infrastructure, enabling silent domain rotation via a single blockchain transaction. It establishes cross-linked persistence hooks in VS Code's tasks.json and Claude Code's settings.json so that deleting either tool's artifact still triggers re-execution from the other. Three C2 domains (npm-cache.com, pypi-get.com, js-mirror.com) were registered within eight seconds on May 22, 2026; the active domain was rotated from npm-cache.com to awqhnjewqjkl.icu on August 4, 2026 via Ethereum transaction 0xc55920f1bd0531b6738153068a666c080ddded47e6256f1fd980d51c0b507c91. Over 400 packages were infected across multiple unrelated publishers, with collective downloads in the hundreds of millions per week.
Three earlier high-profile supply chain incidents contextualize the ChainDrop attack. The XZ Utils backdoor (CVE-2024-3094, CVSS 10.0) was the most sophisticated single-project infiltration ever discovered — a trusted maintainer operating under the pseudonym Jia Tan spent roughly two years social-engineering their way to project maintainership, then inserted a multi-layer obfuscated backdoor in liblzma that intercepted RSA_public_decrypt in sshd to enable pre-authentication RCE. The backdoor was only present in release tarballs, never in Git, hidden inside test files decoded by a configure script. CVE-2025-15467 (CVSS 8.8/9.8) is a stack buffer overflow in OpenSSL's CMS AuthEnvelopedData and EnvelopedData parsing when AEAD ciphers are used — the overflow occurs before any cryptographic authentication, affecting all versions from OpenSSL 3.0.0 through 3.6.0.
The Axios npm supply chain attack of March 31, 2026 demonstrated the social engineering vector: North Korean state actor Sapphire Sleet impersonated a legitimate company, created a fake Slack workspace, invited maintainer Jason Saayman to a fake Teams meeting that prompted installation of a RAT disguised as a Teams update, then used stolen authenticated sessions to publish two malicious Axios versions (1.14.1 and 0.30.4) with a postinstall script connecting to C2 at sfrclak.com:8000.
The GlassWorm campaign, first identified in October 2025 by Koi Security, infected 433+ components across OpenVSX, VS Code Marketplace, GitHub, and npm by March 2026. It used invisible Unicode Private Use Area characters that render as zero-width whitespace — literally invisible to human code reviewers — hidden inside IDE extensions, with a decoder that extracted and eval()d the payload at runtime. GlassWorm used Solana blockchain transaction memos and Google Calendar as dead-drop resolvers for C2 URLs, a novel dynamic resolution technique. Its fourth wave introduced 'sleeper' extensio
Weaknesses (CWE)
CWE-506, CWE-787, CWE-120, CWE-522
Target sectors: technology, software-development, financial-services, government administration, cloud-infrastructure
Target regions: Global
Timeline
- XZ Utils maintainer Jia Tan added malicious test files (bad-3-corrupt_lzma2.xz, good-large_compressed.lzma) to the repository, beginning the two-year supply chain infiltration.
- XZ Utils 5.6.0 released with backdoored tarballs containing the liblzma SSH backdoor — a multi-layer obfuscated IFUNC-based hijacking of RSA_public_decrypt for pre-authentication RCE via sshd.
- Andres Freund publicly disclosed CVE-2024-3094 after observing unusual CPU spikes and valgrind errors on Debian sid. Major Linux distributions issued emergency patches within 24 hours.
- GlassWorm campaign first identified by Koi Security — a self-propagating worm using invisible Unicode PUA characters hidden in OpenVSX extensions, targeting the developer IDE ecosystem.
- CVE-2025-15467 reported by Stanislav Fort (Aisle Research): a stack buffer overflow in OpenSSL's CMS AuthEnvelopedData and EnvelopedData parsing using AEAD ciphers. Affects all OpenSSL 3.x branches.
- OpenSSL released patches for CVE-2025-15467 across all affected branches (3.0.19, 3.3.6, 3.4.4, 3.5.5, 3.6.1). The overflow occurs before cryptographic authentication, making it exploitable without valid key material.
- GlassWorm campaign compromised a legitimate developer's OpenVSX credentials, poisoning 4 established extensions with 22,000+ prior downloads. Transitive dependency attack via extensionPack fields.
- Axios maintainer Jason Saayman targeted by social engineering campaign — attackers impersonated a legitimate company, created a fake Slack workspace with staged members.
- Axios @1.14.1 and @0.30.4 published with malicious postinstall script connecting to sfrclak.com:8000 C2. Attributed to North Korean state actor Sapphire Sleet. Malicious versions removed from npm within 3 hours.
- Earliest chaindrop-related public GitHub repository created matching the worm's exfiltration pattern. ChainDrop infrastructure preparation begins.
- Three C2 domains (js-mirror.com, npm-cache.com, pypi-get.com) registered within 8 seconds via the same registrar. 0.01805723 ETH transferred from FixedFloat to operator wallet 14 minutes later.
- Ethereum StringListStore resolver contract deployed at 0xE1f2395ee43e45A1556EC6438a88c31B83493103. Initial C2 domains written to contract; later narrowed to npm-cache.com only.
Detections & IOCs
As of 2026-09-06, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 28 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
Community OSINT corroboration
1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.
THREAT_INTEL, HIGH, threat intelligence, cybersecurity, CVE-2024-3094, CVE-2025-15467, T1195, T1078, T1566, T1059, T1204, T1546, T1505, T1027, T1553, T1528
