npm supply chain attack

Microsoft’s Analysis of the ChainDrop Attack: A Self-Propagating Worm Infects More Than 400 npm Packages

Microsoft Threat Intelligence analyzed a widespread attack on the npm supply chain in which a credential-stealing worm hid inside more than 400 packages published by different parties. The malware collects secrets from developers and CI/CD environments, then uses npm and GitHub tokens to republish malicious versions and open additional propagation paths.