Microsoft found the malware stole credentials from developer computers and build systems, then used publishing access to spread to additional packages automatically.

Key Takeaways

• Microsoft found malicious updates in more than 400 software packages distributed through npm, the world’s largest software library containing over 80,000 software packages.
• The malware stole passwords and digital access keys that could give attackers access to company code, cloud accounts, and other systems.
• Stolen publishing access allowed the malware to insert itself into additional packages and release infected updates automatically.
• The attack planted instructions that could reactivate the malware when developers later used Claude or Visual Studio Code.

Microsoft Security found the ChainDrop attack compromised more than 400 software packages distributed through npm, the world’s largest software library containing over 80,000 software packages.

The affected packages came from unrelated publishers. Microsoft said many infected versions appeared to be routine updates, even though the packages’ public development records showed no legitimate code changes behind them.

Microsoft identified the malware as a version of Mini Shai-Hulud, a credential-stealing worm that can spread itself. The malicious code could run automatically before a package finished installing.

Malware searched for company credentials

Once active, the malware searched developer computers and automated software build systems for credentials stored in files, software tools and system memory. Software build systems are company systems that assemble code and prepare software for release.

The credentials could provide access to npm, GitHub, Amazon Web Services, Kubernetes and HashiCorp Vault. Those services can contain software code, cloud resources, and passwords or other information used to access company systems.

The malware checked which services the stolen credentials could access and collected additional information available through those accounts. It encrypted the collected data and sent it to an attacker-controlled web address.

Stolen access helped the attack spread

The malware used stolen npm publishing credentials to infect additional software packages automatically.

It downloaded the latest version of each package the compromised publisher could update, inserted the malicious code, and released a new version. One stolen publishing credential could therefore produce infected updates across multiple packages maintained by the same developer or organization.

Microsoft said the malicious releases often appeared as ordinary small updates. In some cases, the malware could use trusted software publishing systems, allowing an infected release to carry records showing that it came through a legitimate process.

Claude files created another infection route

The malware also used stolen GitHub credentials to plant instructions for Anthropic’s Claude and Microsoft’s Visual Studio Code in software projects stored on GitHub.

Those instructions could reactivate the malware when developers later worked on the affected projects using Claude or Visual Studio Code. This created another route for the infection to move between developers working with the affected repositories.

Microsoft tells affected companies to replace credentials

Microsoft said companies that installed an affected package and allowed its setup commands to run should treat the associated developer computer or build system as potentially compromised.

The company recommended replacing exposed credentials from a computer known to be clean. It also advised rebuilding affected systems and any software created on them from trusted sources.

Security teams should check for unauthorized package releases, unexpected changes to software repositories and build processes, and suspicious access to cloud accounts or stored credentials.

Microsoft said the investigation remains active and advised companies to monitor for updated information about affected package versions and newly identified attacker activity.Microsoft Security found the ChainDrop attack compromised more than 400 software packages distributed through npm, a service developers use to download code. The malware stole passwords and access keys, used stolen publishing access to infect more packages automatically, and planted instructions that could reactivate it when developers later used Claude or Visual Studio Code.