npm supply chain attack

Microsoft Analysis of the ChainDrop Attack: Self-Propagating Worm Infects More Than 400 npm Packages

Microsoft Threat Intelligence analyzed a widespread attack on the npm supply chain in which a credential-stealing worm was hidden inside more than 400 packages published by different entities. The malware collects developer and CI/CD environment secrets, then uses npm and GitHub tokens to republish malicious versions and open additional propagation paths.