ChainDrop: Inside a Self-Propagating npm Worm

MITRE Techniques

• [T1059.007 ] JavaScript – ChainDrop executes its payload through Bun and JavaScript dropper files to run the worm and launch credential theft (‘executes Math_Symbol.js or math_init.js via the bun nodejs runtime’).
• [T1059.006 ] Python – An embedded Python helper is used on GitHub Actions runners to locate Runner.Worker and scrape live process memory (‘an embedded Python helper…locates the Runner.Worker process’).
• [T1005 ] Data from Local System – The worm harvests files, configs, tokens, histories, and wallet data from infected hosts (‘it sweeps the infected machine to harvest credentials from the environment’).
• [T1528 ] Steal Application Access Token – It invokes GitHub CLI authentication commands to steal GitHub credentials (‘invokes “gh auth token” to extract the local GitHub CLI authentication token’).
• [T1555 ] Credentials from Password Stores – The payload gathers stored developer and service credentials such as npm, GitHub, SSH, Vault, and cloud secrets (‘Git credentials…npm and GitHub tokens…SSH keys…Vault tokens’).
• [T1057 ] Process Discovery – The memory scraper searches for the Runner.Worker process on GitHub Actions runners (‘locates the Runner.Worker process’).
• [T1003 ] OS Credential Dumping – The worm reads /proc//maps and /proc//mem to extract secrets from process memory (‘opens /proc//maps and /proc//mem’).
• [T1547.001 ] Registry Run Keys / Startup Folder – The malware creates persistence through developer tooling startup hooks and OS autostart mechanisms (‘it writes a .vscode/tasks.json…SessionStart command hook… macOS LaunchAgent… Linux systemd user service’).
• [T1127 ] Trusted Developer Utilities Proxy Execution – It uses legitimate tools like Bun and Claude Code/VS Code hooks as execution vehicles (‘using a legitimate runtime as a portable execution vehicle’).
• [T1105 ] Ingress Tool Transfer – The dropper downloads Bun from GitHub and fetches additional payload material (‘It downloads Bun 1.3.13 from the legitimate Oven GitHub repository’).
• [T1027 ] Obfuscated Files or Information – The payload is heavily obfuscated with Base91, custom permutation, and AES-256-GCM layers (‘protected by three nested layers of obfuscation and encryption’).
• [T1106 ] Native API – The worm reads returned HTTP responses, parses JSON, and evaluates code from the server (‘parses it as JSON and evaluates whatever comes back’).
• [T1090 ] Proxy – It relies on Cloudflare-proxied infrastructure and multiple public RPC endpoints to hide and route C2 traffic (‘both domains are proxied through Cloudflare’s…infrastructure’).
• [T1568.002 ] Domain Generation Algorithms – The new domain is described as randomized and DGA-like (‘randomized 12-character string on the .icu top-level domain’).
• [T1567.002 ] Exfiltration to Cloud Storage – The worm uploads stolen data through GitHub repositories and Actions artifacts as alternate exfiltration paths (‘uploads it as an Actions artifact…public repositories’).
• [T1021.004 ] SSH – The malware steals SSH keys and related access material from developer systems (‘SSH keys’).
• [T1552.001 ] Credentials in Files – It collects secrets from files such as .env, .netrc, and configuration files (‘ .env files .netrc Application configuration’).
• [T1552.004 ] Private Keys – The worm explicitly targets SSH keys and other private key material (‘SSH keys’).
• [T1555.003 ] Credentials from Web Browsers – Not directly mentioned; omitted.
• [T1027.013 ] Encrypted/Encoded File – The exfiltration and payload components are stored and transmitted in encrypted form (‘JSON-serialized, gzipped, encrypted with a random AES-256-GCM key’).