Reading OIDC tokens out of runner memory: ChainDrop and the poisoned build

Where ChainDrop went looking for secrets is the detail worth keeping. Alongside a broad sweep for credentials sitting on developer disks, a hidden Python script read live process memory on GitHub Actions runners to lift temporary OpenID Connect tokens and secrets ^[1]. Federated, short-lived credentials are the standard answer to long-lived keys pasted into CI settings. Reading them out of a running job makes the expiry beside the point, because the worm spends them at once: Unit 42 says it used the stolen npm and GitHub tokens to republish further packages [c9a].

The persistence is the other half of the design. According to Unit 42, ChainDrop wrote cross-linked hooks into developer tooling, including VS Code and Claude Code, and ran its command and control dynamically through Ethereum blockchain transactions ^[4]. Two things follow from that pairing. There is no domain to seize or sinkhole, and the surviving foothold sits on a laptop rather than in a registry or a runner ^[13]. An incident closed when the bad versions are unpublished has been closed in the wrong place.

The scale argument underneath this is arithmetic rather than atmosphere. Unit 42 puts open source at 80 to 90 percent of modern codebases and says the surface now includes developer laptops, CI/CD and cloud infrastructure ^[16]. It also contrasts a project of ten years ago depending on a few dozen external libraries with a simple application today pulling thousands of indirect dependencies ^[17]. Read at the low end of both figures, that is roughly a 55-fold increase in third-party code arriving per build ^[19]. Every one of those arrivals can carry a preinstall hook that fires silently the moment someone runs npm install, and ChainDrop's fired at three targets: build server memory, local editor config such as tasks.json, and rogue repositories used to spread further ^[5].

The reason install-time code works so well is a missing boundary rather than a clever exploit. A browser confines a website to a sandbox; setup scripts and editor extensions have no such walls and inherit the developer's own permissions, free to read files and run commands ^[7]. That permission grant is handed out constantly, across npm, pip, cargo, go and maven installs, by people also running somewhere between 10 and 30 IDE extensions ^[18]. Unit 42's summary is that attackers are aiming at CI/CD pipelines and developer environments to hijack software before it reaches production ^[15], and the ChainDrop mechanics make that concrete.

One caveat on the whole picture: this is a single vendor's research, and the package counts, the payload size and the memory-reading technique are Unit 42's own findings ^[11]. Nobody else in the reporting has confirmed them.