ChainDrop is a self-propagating npm worm that compromises npm packages by stealing maintainer credentials and publishing malicious versions. The malware targets CI/CD pipelines to harvest credentials from build environments. It leverages Bun runtime and uses Ethereum blockchain as a dead-drop mechanism for command-and-control (C2) communications, making detection harder. Dozens of npm packages have been affected by this supply chain attack. The worm spreads autonomously by using stolen credentials to publish compromised versions of legitimate packages. Organizations using affected npm packages in their pipelines are at risk of credential theft and further compromise. Immediate action is recommended to identify and remove affected packages.