Affected Systems

Enterprise cloud environments using open-source dependencies from npm, Go modules, and Packagist registries. Specifically impacts developer workstations and CI/CD pipelines with access to cloud IAM tokens, service account keys, and deployment secrets. Notable campaigns: ChainDrop npm worm (400+ packages including keyv, cacheable-request) and PolinRider (multi-registry). Attributed to North Korea-affiliated actors including Alluring Pisces (Sapphire Sleet/Midnight Neptune).

Exploitation Status

Active exploitation confirmed. ChainDrop infected over 400 npm packages. PolinRider campaign active across npm, Go modules, and Packagist. Recent attributed campaigns targeted Axios, Mastra AI, and Rust's arrayref. Threat actors use Web3 smart contracts (Ethereum, TRON, Aptos, BSC) for dynamic C2 to evade detection and takedown.

Business Impact

Attackers extract ephemeral cloud IAM keys, CI/CD tokens, and OIDC federation credentials from developer endpoints and build pipelines, bypassing traditional authentication perimeters including MFA. Malware executes via preinstall hooks and IDE workspace automation, establishing persistence in developer workflows. Credentials provide direct access to cloud management consoles and APIs. Web3-based C2 using blockchain smart contracts enables dynamic botnet updates and evades domain blocklisting, significantly extending attacker dwell time.

Urgency

🟠 Within 24 hours

Recommended Actions

  • Assess whether Web3 or blockchain network traffic is legitimate for your organization; if not, block all connections to Ethereum, TRON, Aptos, and Binance Smart Chain RPC endpoints at network perimeter and proxy level
  • Deploy endpoint detection and network monitoring to identify and block processes communicating with blockchain networks; correlate with package installation events (npm preinstall, Go module resolution, Packagist composer hooks)
  • Enforce short-lived, scoped IAM credentials for CI/CD runners; implement OIDC federation with time-bound tokens and disable long-lived service account keys on developer workstations
  • Automate security policy controls across all CI/CD runners and version control systems to scan for malicious preinstall scripts, workspace automation files, and repository configuration anomalies before execution
  • Audit installed dependencies for known compromised packages including keyv, cacheable-request, and indicators from PolinRider campaign; review npm, Go, and Packagist lock files for unexpected changes