Attackers are increasingly targeting CI/CD pipelines, developer tools, and package ecosystems rather than finished application code. Unit 42 details the ChainDrop npm worm, which infected 400+ packages including keyv and cacheable-request, stealing OIDC tokens from GitHub Actions runner memory, backdooring VS Code and Claude Code configs, and self-propagating via stolen tokens — all managed through Ethereum-based C2. The post maps the full SDLC attack surface across developer endpoints, build pipelines, and cloud runtimes, arguing that static SBOMs are insufficient. Recommended defenses include disabling npm lifecycle scripts, pinning dependencies to commit SHAs, restricting CI/CD egress, using ephemeral build servers, transitioning to short-lived OIDC credentials, and generating pipeline bills of materials (PBOMs) alongside container SBOMs.
Table of contents
Threat Analysis: ChainDrop npm WormPackage Visibility Across the SDLCTips for Hardening PipelinesQuestions this post answers
How did the ChainDrop npm worm steal credentials from GitHub Actions?
ChainDrop used a malicious preinstall script to download the Bun runtime and launch an obfuscated payload that read live process memory from GitHub Actions runners, extracting temporary OIDC tokens and secrets. It then used those stolen npm and GitHub tokens to silently republish infected versions of additional packages while keeping their legitimate functionality intact so developers wouldn't notice. Developers hardening CI/CD pipelines track emerging npm supply chain threats on daily.dev.
What is a pipeline bill of materials (PBOM) and why is it needed?
A pipeline bill of materials (PBOM) is an inventory of every tool, plugin, and helper script running inside a build system. A standard application SBOM only lists code libraries added to the software, missing the build tooling itself — which attackers target because pipelines hold temporary passwords and cloud access keys. The Trivy supply chain attack illustrates how pipeline security tools themselves can become the attack vector. Teams evaluating CI/CD security posture find coverage of incidents like these on daily.dev.
Why are npm preinstall scripts dangerous and how can I disable them?
npm preinstall scripts run automatically during npm install with the same OS permissions as the user, with no sandboxing. This gives any malicious package immediate access to files, credentials, and the ability to execute arbitrary commands. The ChainDrop worm exploited this to steal secrets and backdoor developer tools. Passing --ignore-scripts to npm disables lifecycle scripts and is a recommended mitigation alongside pinning dependencies to exact commit SHAs. Developers securing their npm workflows stay current on supply chain attack patterns through daily.dev.