# SDLC Supply Chain Attacks: ChainDrop npm Worm and Developer Pipeline Targeting

> A broad, ongoing campaign targeting the software development lifecycle (SDLC) supply chain has escalated in 2025–2026, with the ChainDrop npm worm as the most technically sophisticated case study. ChainDrop infected over 400 npm packages including keyv and cacheable-request via malicious preinstall scripts, stole GitHub Actions OIDC tokens from runner process memory, and managed C2 dynamically through Ethereum blockchain transactions. The campaign also encompasses the XZ Utils backdoor (CVE-2024-3094), the OpenSSL stack buffer overflow (CVE-2025-15467), the Axios supply chain hijacking by North Korea's Sapphire Sleet, and the GlassWorm self-propagating worm using invisible Unicode code in OpenVSX extensions — collectively demonstrating that attackers now systematically target every layer of the developer toolchain.

- **Published:** 2026-08-21T00:00:00Z
- **Last reviewed:** 2026-08-21T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2104
- **ID:** TL-2026-2104
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 28 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2024-3094, CVE-2025-15467

## Description

The software supply chain has become the most lucrative attack surface in modern cybersecurity. Open-source code composes 80-90% of modern codebases, and a single application today pulls in thousands of transitive dependencies across multiple ecosystems. Attackers have responded by shifting focus from finished applications to the development pipeline itself — CI/CD systems, developer workstations, package registries, IDE extensions, and the foundational OS libraries that everything depends on.

The ChainDrop npm worm, disclosed by Microsoft Threat Intelligence and Palo Alto Networks Unit 42 in August 2026, represents a watershed moment in supply chain attack sophistication. A self-propagating worm in the Mini Shai-Hulud lineage, ChainDrop infects packages through a three-step chain: (1) a malicious preinstall hook in package.json that executes a 727KB obfuscated Bun-based JavaScript payload, (2) credential theft spanning developer workstations and CI/CD runners (including live process-memory scraping of GitHub Actions OIDC tokens), and (3) automated propagation — the worm republishes infected packages using stolen npm tokens, incrementing only the patch version. The worm uses an Ethereum smart contract (StringListStore at address 0xE1f2395ee43e45A1556EC6438a88c31B83493103) for dynamic C2 domain resolution with no hardcoded infrastructure, enabling silent domain rotation via a single blockchain transaction. It establishes cross-linked persistence hooks in VS Code's tasks.json and Claude Code's settings.json so that deleting either tool's artifact still triggers re-execution from the other. Three C2 domains (npm-cache.com, pypi-get.com, js-mirror.com) were registered within eight seconds on May 22, 2026; the active domain was rotated from npm-cache.com to awqhnjewqjkl.icu on August 4, 2026 via Ethereum transaction 0xc55920f1bd0531b6738153068a666c080ddded47e6256f1fd980d51c0b507c91. Over 400 packages were infected across multiple unrelated publishers, with collective downloads in the hundreds of millions per week.

Three earlier high-profile supply chain incidents contextualize the ChainDrop attack. The XZ Utils backdoor (CVE-2024-3094, CVSS 10.0) was the most sophisticated single-project infiltration ever discovered — a trusted maintainer operating under the pseudonym Jia Tan spent roughly two years social-engineering their way to project maintainership, then inserted a multi-layer obfuscated backdoor in liblzma that intercepted RSA_public_decrypt in sshd to enable pre-authentication RCE. The backdoor was only present in release tarballs, never in Git, hidden inside test files decoded by a configure script. CVE-2025-15467 (CVSS 8.8/9.8) is a stack buffer overflow in OpenSSL's CMS AuthEnvelopedData and EnvelopedData parsing when AEAD ciphers are used — the overflow occurs before any cryptographic authentication, affecting all versions from OpenSSL 3.0.0 through 3.6.0.

The Axios npm supply chain attack of March 31, 2026 demonstrated the social engineering vector: North Korean state actor Sapphire Sleet impersonated a legitimate company, created a fake Slack workspace, invited maintainer Jason Saayman to a fake Teams meeting that prompted installation of a RAT disguised as a Teams update, then used stolen authenticated sessions to publish two malicious Axios versions (1.14.1 and 0.30.4) with a postinstall script connecting to C2 at sfrclak.com:8000.

The GlassWorm campaign, first identified in October 2025 by Koi Security, infected 433+ components across OpenVSX, VS Code Marketplace, GitHub, and npm by March 2026. It used invisible Unicode Private Use Area characters that render as zero-width whitespace — literally invisible to human code reviewers — hidden inside IDE extensions, with a decoder that extracted and eval()d the payload at runtime. GlassWorm used Solana blockchain transaction memos and Google Calendar as dead-drop resolvers for C2 URLs, a novel dynamic resolution technique. Its fourth wave introduced 'sleeper' extensions — 73+ extensions uploaded as innocuous then later updated to deliver malicious payloads via thin loaders.

The Unit 42 report frames these incidents within three SDLC attack domains: endpoint (developer workstations with npm install, pip install, cargo build, and 10-30 IDE extensions lacking sandboxing), CI/CD pipelines (packed with temporary passwords and cloud access keys, targeted by build-process injection), and cloud runtime (where container images bundle hidden OS-layer tools like OpenSSL that evade application-level scanning). Recommended hardening includes disabling lifecycle install scripts (npm --ignore-scripts), enforcing package cooldown periods, restricting CI/CD egress traffic, using ephemeral CI/CD servers, pinning dependencies to exact commit SHAs, adopting short-lived OIDC authentication, and enforcing end-to-end cryptographic provenance from signed commits to signed artifacts.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1566 Phishing
- T1059 Command and Scripting Interpreter
- T1204 User Execution
- T1546 Event Triggered Execution
- T1505 Server Software Component
- T1027 Obfuscated Files or Information
- T1553 Subvert Trust Controls
- T1528 Steal Application Access Token
- T1552 Unsecured Credentials
- T1649 Steal or Forge Authentication Certificates
- T1087 Account Discovery
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1568 Dynamic Resolution
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction

## Sources

- [Connecting the Dots: Securing the Overlooked Corners of the SDLC Supply Chain](https://unit42.paloaltonetworks.com/sdlc-supply-chain/)
- [ChainDrop: Inside a Self-Propagating npm Worm](https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/)
- [ChainDrop Supply Chain Compromise: Anatomy of a Self-Propagating Worm](https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/)
- [Tracking Shai-Hulud: Inside ChainDrop NPM Worm](https://www.zscaler.com/blogs/security-research/tracking-shai-hulud-inside-chaindrop-npm-worm)
- [ChainDrop NPM Worm: Preinstall, OIDC Republish, and GitHub Actions Secret Dump](https://www.osbytes.io/blog/chaindrop-npm-worm-preinstall-oidc-republish-and-github-actions-secret-dump)
- [ChainDrop: When Opening a Repository Becomes Execution](https://www.pillar.security/blog/chaindrop-when-opening-a-repository-becomes-execution)
- [CVE-2024-3094: XZ Utils Backdoor Analysis](https://www.crowdstrike.com/en-us/blog/cve-2024-3094-xz-upstream-supply-chain-attack/)
- [XZ Backdoor Teardown](https://stevenfoerster.com/notes/xz-backdoor-teardown/)
- [CVE-2025-15467 OpenSSL Advisory](https://ubuntu.com/security/CVE-2025-15467)
- [Axios npm Supply Chain Compromise Post-Mortem](https://github.com/axios/axios/issues/10636)
- [Mitigating the Axios npm Supply Chain Compromise](https://www.microsoft.com/en-us/security/blog/2026/04/01/mitigating-the-axios-npm-supply-chain-compromise/)
- [GlassWorm: First Self-Propagating Worm Using Invisible Code Hits OpenVSX Marketplace](https://www.koi.ai/blog/glassworm-first-self-propagating-worm-using-invisible-code-hits-openvsx-marketplace)
- [GlassWorm Malware Hits 400+ Code Repos on GitHub, npm, VS Code, OpenVSX](https://www.bleepingcomputer.com/news/security/glassworm-malware-hits-400-plus-code-repos-on-github-npm-vscode-openvsx/)
- [GlassWorm Malware Attacks Return Via 73 OpenVSX Sleeper Extensions](https://www.bleepingcomputer.com/news/security/glassworm-malware-attacks-return-via-73-openvsx-sleeper-extensions/)
- [Axios npm Hack Used Fake Teams Error Fix to Hijack Maintainer Account](https://www.bleepingcomputer.com/news/security/axios-npm-hack-used-fake-teams-error-fix-to-hijack-maintainer-account/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2104