--- analysis: This hunt pivots from IDE configuration files to blockchain-based network activity and then to GitHub package audit logs. A single detection rule cannot link these across multiple surfaces to confirm a self-propagating infection. blind_spots: - id: no-endpoint-telemetry question: whether the hook files exist on hosts not reporting file activity requires: hb_file_activity coverage on all developer workstations risk: An infected workstation with no telemetry can re-infect the repository indefinitely. stage: developer-tooling-persistence - id: ephemeral-runners question: whether the C2 resolution happened within a short-lived GitHub Actions job requires: Real-time DNS logging for ephemeral CI runners risk: The DNS lookup may vanish before it is collected if the runner environment is destroyed immediately after the job. stage: blockchain-c2-routing coverage: - stage: developer-tooling-persistence status: covered steps: - detect-worm-hooks - check-latent-persistence - stage: blockchain-c2-routing status: covered steps: - check-blockchain-c2 - stage: automated-package-propagation status: covered steps: - check-npm-propagation - reason: 'Belongs to another part of the ''ChainDrop: Inside a Self-Propagating npm Worm'' series.' stage: npm-supply-chain-compromise status: out_of_scope - reason: 'Belongs to another part of the ''ChainDrop: Inside a Self-Propagating npm Worm'' series.' stage: npm-lifecycle-hook-execution status: out_of_scope - reason: 'Belongs to another part of the ''ChainDrop: Inside a Self-Propagating npm Worm'' series.' stage: portable-runtime-dropper status: out_of_scope - reason: 'Belongs to another part of the ''ChainDrop: Inside a Self-Propagating npm Worm'' series.' stage: credential-and-environment-sweep status: out_of_scope - reason: 'Belongs to another part of the ''ChainDrop: Inside a Self-Propagating npm Worm'' series.' stage: ci-runner-memory-access status: out_of_scope guardrails: claims: no_unsupported evidence: citation_required missing_data: not_benign telemetry: untrusted hunt: applicability: campaign-specific handoff: promote-to-detection justification: The ChainDrop worm compromises the software supply chain by weaponizing developer tools; this hunt validates that no automated persistence or propagation is active on our contributors' machines. methodology: model-assisted trigger: intel-report hypothesis: An adversary has compromised developer environments by injecting malicious hooks into IDE configuration files, using automated GitHub workflows to propagate an npm worm and resolve C2 via Ethereum smart contracts. labels: - hunt - attack.t1546 - attack.t1102 - attack.t1534 - attack.t1574.006 name: 'ChainDrop Worm: Developer Tooling Persistence and Supply Chain Propagation' parameters: eth_gateways: default: - mainnet.infura.io - api.etherscan.io - cloudflare-eth.com - eth-mainnet.g.alchemy.com description: Ethereum API and gateway domains used for blockchain-based C2 resolution. from: kind: article observed: '2026-08-06' ref: chaindrop-analysis type: list[domain] lookback_days: default: '14' description: Days of history to examine. from: kind: manual observed: '2026-08-06' ref: default-retention type: number scope_github_users: default: [] description: GitHub identities (organizations or logins) associated with infected workstations. from: kind: manual observed: '2026-08-06' ref: scoping-result type: list[string] scope_hosts: default: [] description: Limit analysis to specific hosts found in the initial scoping step. from: kind: manual observed: '2026-08-06' ref: scoping-result type: list[host] worm_artifacts: default: - math_init.js - setup.mjs description: Unique filenames associated with the worm's hooks and droppers. from: kind: article observed: '2026-08-06' ref: chaindrop-analysis type: list[string] provenance: authors: - name: Huntbase hunt generation org: huntbase.io generated: by: huntbase-hunt-generation from: https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ gates: - dry-run - lint model: hb_google/gemini-3-flash-preview rationale: Focus on developer endpoints and CI/CD environments. Prioritize users with 'maintainer' or 'owner' roles in GitHub and npm repositories. references: - name: 'ChainDrop: Inside a Self-Propagating npm Worm' url: https://unit42.paloaltonetworks.com/chaindrop-npm-worm-analysis/ related: - hunt: npm-supply-chain-compromise reason: Initial infection via typosquatted packages is covered by the primary supply chain hunt; this hunt focuses on the worm's lifecycle. relation: out-of-scope-alternative - hunt: chaindrop-npm-worm-activity relation: follows scenario: stages: - name: Trojanized npm Package Installation observables: - registry.npmjs.org - keyv - cacheable-request slug: npm-supply-chain-compromise tactic: initial-access techniques: - T1195.002 - name: NPM Preinstall Hook Execution observables: - preinstall - node setup.mjs slug: npm-lifecycle-hook-execution tactic: execution techniques: - T1059.003 - name: Bun Runtime Dropper and Payload Execution observables: - setup.mjs - math_init.js - Bun 1.3.13 - Oven GitHub repository - _NODE_RUNTIME_INIT=1 slug: portable-runtime-dropper tactic: execution techniques: - T1105 - name: Filesystem and Environment Credential Harvest observables: - .env - .git-credentials - .netrc - SSH keys - npm tokens - GitHub tokens - Kubernetes service-account tokens slug: credential-and-environment-sweep tactic: credential-access techniques: - T1552.001 - T1555 - name: CI Runner Process Memory Scraping observables: - Runner.Worker - /proc/pid/maps - /proc/pid/mem - OIDC tokens slug: ci-runner-memory-access tactic: credential-access techniques: - T1003.001 - name: Persistence via VS Code and Claude Code Hooks observables: - .vscode/tasks.json - .claude/settings.json - Environment Setup - SessionStart - .claude/math_init.js - com.user.gh-token-monitor - gh-token-monitor.service slug: developer-tooling-persistence tactic: persistence techniques: - T1546 - name: Ethereum Smart Contract C2 Resolution observables: - Ethereum transaction - blockchain-based C2 resolution slug: blockchain-c2-routing tactic: command-and-control techniques: - T1102 - name: Worm Propagation via Package Republishing observables: - 'Shai-Hulud: Here We Go Again' - .github/workflows/codeql_analysis.yml - npm:registry.npmjs.org - release-drafter.yml - /opensearch-js slug: automated-package-propagation tactic: lateral-movement techniques: - T1534 - T1574.006 summary: ChainDrop is a self-propagating npm worm that infects developer environments via trojanized package lifecycle hooks to harvest cloud credentials, SSH keys, and CI runner secrets. It persists through cross-linked VS Code and AI tool configurations and uses Ethereum smart contracts for C2 routing to spread by republishing infected versions of legitimate packages. series: index: 2 slug: chaindrop-inside-a-self-propagating-npm-worm title: 'ChainDrop: Inside a Self-Propagating npm Worm' total: 2 severity: high targets: analyst: name: Tier-2 analyst role: analyst endpoint: category: endpoint name: Endpoint telemetry (hb_ surfaces) telemetry: - endpoint github: category: siem huntbase: product: github name: github hunter: agent: true name: Hunt agent tlp: clear type: investigation --- # ChainDrop Worm: Developer Tooling Persistence and Supply Chain Propagation ChainDrop is a self-propagating npm worm targeting workstations and CI/CD runners. This hunt focuses on identifying persistence within VS Code and Claude Code configurations, detecting latent system services, and uncovering blockchain-based C2 routing. It concludes by verifying whether the infected account has propagated the worm by republishing malicious npm packages. The workflow uses file telemetry to find hooks, DNS activity to find Ethereum resolution, and GitHub audit logs to confirm supply chain impact. ## detect-worm-hooks Identify the creation of unique malicious hooks in VS Code and Claude Code directories that trigger the worm's dropper. ```sqlite target=endpoint role=detection-candidate params=(lookback_days=lookback_days, worm_artifacts=worm_artifacts) ~~~yaml expected: Rows indicating the creation of unique dropper or payload files in hidden developer directories like .vscode or .claude. reads: - device_hostname - actor_user_name - file_path - file_name - time - activity_id silence: not_evidence_of_absence source: hb_file_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, actor_user_name, file_path, file_name, time FROM hb_file_activity WHERE instr(',' || '{{worm_artifacts}}' || ',', ',' || LOWER(file_name) || ',') > 0 AND (LOWER(file_path) LIKE '%\.vscode\%' OR LOWER(file_path) LIKE '%\.claude\%') AND activity_id IN (1, 3, 5) AND time >= datetime('now', '-{{lookback_days}} days') ``` ## corroborate-infection parallel: - → check-latent-persistence - → check-blockchain-c2 - → check-npm-propagation join: → triage-findings ## check-latent-persistence Search for the installation of the macOS LaunchAgent or Linux systemd service described in the latent capability of the worm. ```sqlite target=endpoint role=enrichment params=(lookback_days=lookback_days, scope_hosts=scope_hosts) ~~~yaml expected: A LaunchAgent or systemd unit named gh-token-monitor; silence indicates the latent capability was not activated on the identified hosts. reads: - device_hostname - job_name - job_definition_path - time silence: not_evidence_of_absence source: hb_scheduled_job verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, job_name, job_definition_path, time FROM hb_scheduled_job WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND (LOWER(job_name) LIKE '%gh-token-monitor%' OR LOWER(job_definition_path) LIKE '%gh-token-monitor%') AND time >= datetime('now', '-{{lookback_days}} days') ``` ## check-blockchain-c2 Identify anomalous DNS requests to Ethereum gateways used by the worm to resolve its dynamic C2 infrastructure. ```sqlite target=endpoint role=baseline params=(lookback_days=lookback_days, eth_gateways=eth_gateways, scope_hosts=scope_hosts) ~~~yaml baseline: compare: first_seen window: '{{lookback_days}}d' expected: Rare resolution of Ethereum gateways from identified suspect hosts. Correlation with the worm's lead files increases confidence. prevalence: by: device_hostname key: - query_hostname rare_below: 3 reads: - device_hostname - query_hostname - process_name - time silence: not_evidence_of_absence source: hb_dns_activity verified: dry-run verified_at: '2026-09-20' ~~~ SELECT device_hostname, query_hostname, process_name, COUNT(*) AS lookups, MIN(time) AS first_seen FROM hb_dns_activity WHERE ('{{scope_hosts}}' = '' OR instr(',' || '{{scope_hosts}}' || ',', ',' || device_hostname || ',') > 0) AND instr(',' || '{{eth_gateways}}' || ',', ',' || LOWER(query_hostname) || ',') > 0 AND time >= datetime('now', '-{{lookback_days}} days') GROUP BY device_hostname, query_hostname, process_name ``` ## check-npm-propagation Query GitHub package logs to find npm packages updated during the infection window for specific identities. ```sqlite target=github role=triage params=(lookback_days=lookback_days, scope_github_users=scope_github_users) ~~~yaml expected: A list of recently published packages for manual correlation with infected workstations and identities. reads: - name - organization - updated_at silence: not_evidence_of_absence source: github_package verified: dry-run verified_at: '2026-09-20' ~~~ SELECT name, organization, updated_at FROM github_package WHERE package_type = 'npm' AND ('{{scope_github_users}}' = '' OR instr(',' || '{{scope_github_users}}' || ',', ',' || organization || ',') > 0) AND updated_at >= datetime('now', '-{{lookback_days}} days') ``` ## triage-findings ```agent target=hunter cite: required context: - detect-worm-hooks - check-latent-persistence - check-blockchain-c2 - check-npm-propagation max_iterations: 4 objective: Determine if the observed IDE hooks and network resolution patterns indicate an active ChainDrop infection and if propagation has occurred. success_criteria: A verdict of malicious for hosts exhibiting both hook files and blockchain activity, or suspicious for those with hook files only. tools: - endpoint - github ``` ## route-on-verdict if~: "the triage verdict is malicious for at least one host" (confidence: high, judge=hunter) then: → contain-and-revoke indeterminate: → manual-review unavailable: → manual-review (blind_spot: no-endpoint-telemetry) else: → manual-review ## contain-and-revoke ```action target=endpoint ~~~yaml approval: required ~~~ Isolate the host immediately. Revoke all GitHub and npm tokens associated with the identity found on the workstation. Delete the .vscode and .claude directories containing the hooks. ``` → manual-review ## manual-review ```manual target=analyst Review the packages listed in the propagation step. Cross-reference their update time with the workstation infection window. Audit the package contents for the setup.mjs and preinstall hooks. ``` → close-out ## close-out ```manual target=analyst Record the impact on the software supply chain. Notify downstream consumers if infected packages were confirmed. Recommend standing detection for unique malicious filenames in IDE configuration paths. ``` → end