ChainDrop Malware Infects Over 1,300 npm Packages in Record Supply Chain Poisoning Campaign

ChainDrop malware has infected more than 1,300 npm packages with a combined monthly download volume of 2 billion, marking one of the largest supply chain poisoning incidents recorded to date. If you updated an npm dependency in the past week, your development credentials may already have been exfiltrated to attacker infrastructure.

The attack begins when an infected package executes inside a developer environment. It first reads the local .npmrc file to extract npm authentication tokens. Next, it scans for SSH keys and Git configuration files to obtain access to code repositories. Finally, the malware uses the stolen npm token to publish malicious updates to any other packages owned by the same account, creating a self-replicating infection chain.

Simultaneously, the Open VSX marketplace removed 77 malicious extensions that used a “twin” naming strategy to impersonate legitimate developer tools. These extensions collected hostnames, repository metadata, CI environment variables, and credential files. Their combined download count exceeded one million.

A third vector, dubbed HalluSquatting, targets AI coding assistants. Attackers monitor suggestions from tools such as GitHub Copilot, Cursor, and Claude Code for non-existent package names. Once a frequently hallucinated name is identified, the attacker registers the package with malicious code. Developers who accept the AI-generated import statement unknowingly install the backdoor.

The three incidents underscore the expanding attack surface of modern software supply chains. With more than three million packages in the npm ecosystem and thousands of new versions published daily, traditional “trust your direct dependencies” approaches are no longer sufficient. Defenses must now cover lockfiles, token scoping, and verification of AI-suggested packages.

Recommended mitigations include pinning all direct and transitive dependencies with integrity hashes, issuing npm tokens with publish rights only when necessary, and manually checking any package name suggested by an AI assistant for recent registration dates or missing maintainer information.