ChainDrop npm Attack Compromises Hundreds of Packages

A sophisticated software supply chain attack named ChainDrop has infected hundreds of npm packages, including popular caching libraries with millions of weekly downloads. Beginning August 4, 2026, attackers compromised a GitHub account of a keyv package maintainer, injecting malicious code into legitimate repositories. The malware executes credential-stealing payloads targeting developer workstations and CI/CD runners, harvesting npm tokens, GitHub credentials, cloud access keys, SSH keys, and database credentials. Using stolen credentials, the worm self-propagates by compromising additional repositories and publishing poisoned packages with valid provenance attestations. ChainDrop employs Bun runtime for execution, establishes persistence through developer tool configurations, and exfiltrates encrypted data using blockchain-based command-and-control infrastructure. This campaign represents an evolution of the Shai-Hulud npm worm.

• Black October for AI Developer PlatformsCampaign2026-10-31
• Grand Theft Auto VI Release Phishing LuresMalware2026-11-05
• Not Actually Suspended: How a Bank-Phishing Network Fakes Its Own TakedownPhishing2026-11-04
• From Business Emails to XLoader: An Order Lure That Led to In-Memory InjectionMalware2026-11-04
• Inside a malicious Claude Code-branded extension and its persistent SSH backdoorMalware2026-10-31