SDLC Supply Chain Attacks: ChainDrop npm Worm and Developer Pipeline Targeting

SDLC Supply Chain Attacks (TL-2026-2104), also tracked as ChainDrop Campaign, is a high-severity tracked intrusion set, first published 2026-08-21. It has no confirmed attribution, affects npm (Node.js package ecosystem) npm Ecosystem, references 2 CVEs (CVE-2024-3094, CVE-2025-15467), maps to 18 MITRE ATT&CK techniques (T1005, T1027, T1059), and is covered by 9 detection rules and 28 indicators of compromise.

Key facts for TL-2026-2104

Threat ID
TL-2026-2104
Also known as
ChainDrop Campaign, Mini Shai-Hulud Campaign
Severity
HIGH
Status
ACTIVE
Category
THREAT_INTEL
First published
2026-08-21
Last reviewed
2026-08-21
Attribution confidence
MEDIUM
Motivation
ESPIONAGE
Target sectors
technology, software-development, financial-services, government administration, cloud-infrastructure
Target regions
Global
Detection rules
9
Indicators of compromise
28

Malware and tooling in SDLC Supply Chain Attacks

Malware and tooling: GlassWorm, Mini Shai-Hulud, Shai-Hulud, Ethereum StringListStore at 0xE1f2395ee43e45A1556EC6438a88c31B83493103

A broad, ongoing campaign targeting the software development lifecycle (SDLC) supply chain has escalated in 2025–2026, with the ChainDrop npm worm as the most technically sophisticated case study. ChainDrop infected over 400 npm packages including keyv and cacheable-request via malicious preinstall scripts, stole GitHub Actions OIDC tokens from runner process memory, and managed C2 dynamically through Ethereum blockchain transactions. The campaign also encompasses the XZ Utils backdoor (CVE-2024-3094), the OpenSSL stack buffer overflow (CVE-2025-15467), the Axios supply chain hijacking by North Korea's Sapphire Sleet, and the GlassWorm self-propagating worm using invisible Unicode code in OpenVSX extensions — collectively demonstrating that attackers now systematically target every layer of the developer toolchain.

How SDLC Supply Chain Attacks works

The software supply chain has become the most lucrative attack surface in modern cybersecurity. Open-source code composes 80-90% of modern codebases, and a single application today pulls in thousands of transitive dependencies across multiple ecosystems. Attackers have responded by shifting focus from finished applications to the development pipeline itself — CI/CD systems, developer workstations, package registries, IDE extensions, and the foundational OS libraries that everything depends on.

The ChainDrop npm worm, disclosed by Microsoft Threat Intelligence and Palo Alto Networks Unit 42 in August 2026, represents a watershed moment in supply chain attack sophistication. A self-propagating worm in the Mini Shai-Hulud lineage, ChainDrop infects packages through a three-step chain: (1) a malicious preinstall hook in package.json that executes a 727KB obfuscated Bun-based JavaScript payload, (2) credential theft spanning developer workstations and CI/CD runners (including live process-memory scraping of GitHub Actions OIDC tokens), and (3) automated propagation — the worm republishes infected packages using stolen npm tokens, incrementing only the patch version. The worm uses an Ethereum smart contract (StringListStore at address 0xE1f2395ee43e45A1556EC6438a88c31B83493103) for dynamic C2 domain resolution with no hardcoded infrastructure, enabling silent domain rotation via a single blockchain transaction. It establishes cross-linked persistence hooks in VS Code's tasks.json and Claude Code's settings.json so that deleting either tool's artifact still triggers re-execution from the other. Three C2 domains (npm-cache.com, pypi-get.com, js-mirror.com) were registered within eight seconds on May 22, 2026; the active domain was rotated from npm-cache.com to awqhnjewqjkl.icu on August 4, 2026 via Ethereum transaction 0xc55920f1bd0531b6738153068a666c080ddded47e6256f1fd980d51c0b507c91. Over 400 packages were infected across multiple unrelated publishers, with collective downloads in the hundreds of millions per week.

Three earlier high-profile supply chain incidents contextualize the ChainDrop attack. The XZ Utils backdoor (CVE-2024-3094, CVSS 10.0) was the most sophisticated single-project infiltration ever discovered — a trusted maintainer operating under the pseudonym Jia Tan spent roughly two years social-engineering their way to project maintainership, then inserted a multi-layer obfuscated backdoor in liblzma that intercepted RSA_public_decrypt in sshd to enable pre-authentication RCE. The backdoor was only present in release tarballs, never in Git, hidden inside test files decoded by a configure script. CVE-2025-15467 (CVSS 8.8/9.8) is a stack buffer overflow in OpenSSL's CMS AuthEnvelopedData and EnvelopedData parsing when AEAD ciphers are used — the overflow occurs before any cryptographic authentication, affecting all versions from OpenSSL 3.0.0 through 3.6.0.

The Axios npm supply chain attack of March 31, 2026 demonstrated the social engineering vector: North Korean state actor Sapphire Sleet impersonated a legitimate company, created a fake Slack workspace, invited maintainer Jason Saayman to a fake Teams meeting that prompted installation of a RAT disguised as a Teams update, then used stolen authenticated sessions to publish two malicious Axios versions (1.14.1 and 0.30.4) with a postinstall script connecting to C2 at sfrclak.com:8000.

The GlassWorm campaign, first identified in October 2025 by Koi Security, infected 433+ components across OpenVSX, VS Code Marketplace, GitHub, and npm by March 2026. It used invisible Unicode Private Use Area characters that render as zero-width whitespace — literally invisible to human code reviewers — hidden inside IDE extensions, with a decoder that extracted and eval()d the payload at runtime. GlassWorm used Solana blockchain transaction memos and Google Calendar as dead-drop resolvers for C2 URLs, a novel dynamic resolution technique. Its fourth wave introduced 'sleeper' extensions — 73+ extensions uploaded as innocuous then later updated to deliver malicious payloads via thin loaders.

The Unit 42 report frames these incidents within three SDLC attack domains: endpoint (developer workstations with npm install, pip install, cargo build, and 10-30 IDE extensions lacking sandboxing), CI/CD pipelines (packed with temporary passwords and cloud access keys, targeted by build-process injection), and cloud runtime (where container images bundle hidden OS-layer tools like OpenSSL that evade application-level scanning). Recommended hardening includes disabling lifecycle install scripts (npm --ignore-scripts), enforcing package cooldown periods, restricting CI/CD egress traffic, using ephemeral CI/CD servers, pinning dependencies to exact commit SHAs, adopting short-lived OIDC authentication, and enforcing end-to-end cryptographic provenance from signed commits to signed artifacts.

MITRE ATT&CK techniques used in TL-2026-2104

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1568 Dynamic Resolution

Initial Access

T1078 Valid Accounts; T1195 Supply Chain Compromise; T1566 Phishing

Discovery

T1087 Account Discovery

Impact

T1485 Data Destruction

Persistence

T1505 Server Software Component; T1546 Event Triggered Execution

Credential Access

T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1649 Steal or Forge Authentication Certificates

defense-impairment

T1553 Subvert Trust Controls

Exfiltration

T1567 Exfiltration Over Web Service

Affected products and versions in SDLC Supply Chain Attacks

  • npm (Node.js package ecosystem) — npm Ecosystem
    Vulnerable versions: npm packages with preinstall hooks enabled (all CLI versions prior to v12)
    Fixed in: npm CLI v12+
  • Tukaani — XZ Utils / liblzma
    Vulnerable versions: 5.6.0; 5.6.1
    Fixed in: 5.5.2 or earlier; post-5.6.1 patched releases
  • OpenSSL Software Foundation — OpenSSL
    Vulnerable versions: 3.0.0-3.0.18; 3.3.0-3.3.5; 3.4.0-3.4.3; 3.5.0-3.5.4; 3.6.0
    Fixed in: 3.0.19; 3.3.6; 3.4.4; 3.5.5; 3.6.1
  • Axios — axios npm package
    Vulnerable versions: 1.14.1; 0.30.4
    Fixed in: 1.14.0; 0.30.3
  • OpenVSX / VS Code Marketplace — IDE Extensions
    Vulnerable versions: Multiple extensions (433+ components across ecosystems, ongoing)
    Fixed in: No fixed version; rotate tokens and audit extensions

Remediation for SDLC Supply Chain Attacks

Patches

  • Apply XZ Utils fix for CVE-2024-3094 (revert to 5.5.2 or later patched version)
  • Apply OpenSSL 3.0.19, 3.3.6, 3.4.4, 3.5.5, or 3.6.1 for CVE-2025-15467
  • npm CLI v12+ with script-blocking enforcement

Immediate actions

  • Review npm packages for unexpected preinstall/postinstall lifecycle scripts
  • Scan for known ChainDrop file hashes (9fc2570b..., 54dc7ea..., fd3ca40..., b27b82a...)
  • Rotate all npm and GitHub tokens that may have been exposed
  • Check VS Code .vscode/tasks.json and Claude Code .claude/settings.json for hooks
  • Run npm CLI v12 or later which blocks unnecessary lifecycle scripts
  • Upgrade OpenSSL to 3.0.19+/3.3.6+/3.4.4+/3.5.5+/3.6.1+ for CVE-2025-15467

Workarounds

  • Avoid npm install --ignore-scripts or selectively disable preinstall hooks
  • Review package.json changes before running npm install on updated packages
  • Restrict npm publish permissions to OIDC-only with no long-lived tokens
  • Disable auto-update mechanisms for transitive dependencies

Longer-term hardening

  • Disable npm lifecycle install scripts globally (npm config set ignore-scripts true)
  • Enforce package cooldown periods and manual review for patch-version bumps
  • Restrict CI/CD egress traffic to known-good endpoints only
  • Use ephemeral CI/CD runners with no persistent secrets
  • Pin all dependencies to exact commit SHAs
  • Adopt short-lived OIDC authentication in place of long-lived credentials
  • Enforce end-to-end cryptographic provenance: signed commits to signed artifacts/SBOMs
  • Maintain a Pipeline Bill of Materials (PBOM) alongside application SBOMs
  • Audit and remove unverified IDE extensions, monitor extensionDependencies changes
  • Use container SBOMs to capture hidden OS-layer dependencies like OpenSSL

CVEs associated with SDLC Supply Chain Attacks

CVE-2024-3094, CVE-2025-15467

Weaknesses (CWE) in SDLC Supply Chain Attacks

CWE-506, CWE-787, CWE-120, CWE-522

Timeline of SDLC Supply Chain Attacks

  • XZ Utils maintainer Jia Tan added malicious test files (bad-3-corrupt_lzma2.xz, good-large_compressed.lzma) to the repository, beginning the two-year supply chain infiltration.
  • XZ Utils 5.6.0 released with backdoored tarballs containing the liblzma SSH backdoor — a multi-layer obfuscated IFUNC-based hijacking of RSA_public_decrypt for pre-authentication RCE via sshd.
  • Andres Freund publicly disclosed CVE-2024-3094 after observing unusual CPU spikes and valgrind errors on Debian sid. Major Linux distributions issued emergency patches within 24 hours.
  • GlassWorm campaign first identified by Koi Security — a self-propagating worm using invisible Unicode PUA characters hidden in OpenVSX extensions, targeting the developer IDE ecosystem.
  • CVE-2025-15467 reported by Stanislav Fort (Aisle Research): a stack buffer overflow in OpenSSL's CMS AuthEnvelopedData and EnvelopedData parsing using AEAD ciphers. Affects all OpenSSL 3.x branches.
  • OpenSSL released patches for CVE-2025-15467 across all affected branches (3.0.19, 3.3.6, 3.4.4, 3.5.5, 3.6.1). The overflow occurs before cryptographic authentication, making it exploitable without valid key material.
  • GlassWorm campaign compromised a legitimate developer's OpenVSX credentials, poisoning 4 established extensions with 22,000+ prior downloads. Transitive dependency attack via extensionPack fields.
  • Axios maintainer Jason Saayman targeted by social engineering campaign — attackers impersonated a legitimate company, created a fake Slack workspace with staged members.
  • Axios @1.14.1 and @0.30.4 published with malicious postinstall script connecting to sfrclak.com:8000 C2. Attributed to North Korean state actor Sapphire Sleet. Malicious versions removed from npm within 3 hours.
  • Earliest chaindrop-related public GitHub repository created matching the worm's exfiltration pattern. ChainDrop infrastructure preparation begins.
  • Three C2 domains (js-mirror.com, npm-cache.com, pypi-get.com) registered within 8 seconds via the same registrar. 0.01805723 ETH transferred from FixedFloat to operator wallet 14 minutes later.
  • Ethereum StringListStore resolver contract deployed at 0xE1f2395ee43e45A1556EC6438a88c31B83493103. Initial C2 domains written to contract; later narrowed to npm-cache.com only.
  • Microsoft Threat Intelligence and Unit 42 publish simultaneous analyses of ChainDrop worm. 453 public GitHub repositories identified across 5 accounts. C2 domain rotated from npm-cache.com to awqhnjewqjkl.icu via Ethereum transaction at 15:15 UTC. New domain registered via NameSilo with DGA-like 12-char .icu TLD.
  • Unit 42 publishes 'Connecting the Dots: Securing the Overlooked Corners of the SDLC Supply Chain,' framing ChainDrop within the broader SDLC attack surface across endpoints, CI/CD pipelines, and cloud runtime.

Sources cited for SDLC Supply Chain Attacks

Threats related to SDLC Supply Chain Attacks

Detection coverage for TL-2026-2104

As of 2026-08-21, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-2104 across Splunk SPL, Microsoft KQL and Sigma, covering 28 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Community OSINT corroboration for TL-2026-2104

1 of this threat's indicators have also been reported by the open-source security community, which observed at least one of them before this report was published. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats