On August 4, 2026, a malicious commit to the npm package 'keyv' triggered a supply-chain worm that compromised over 400 packages (Elastic) or over 1,300 package versions (Singapore's CSA), totaling mo…
Microsoft's security research team tracked a campaign called 'ChainDrop' that took over an npm maintainer account and published trojanized releases across more than 400 packages, harvesting credential…
Researchers at Phylum have identified a new npm supply chain worm, dubbed ChainDrop, that evades standard defenses by using a multi-stage attack chain. The worm spreads through malicious packages and …
A self-propagating npm worm called ChainDrop compromised 444 packages, including keyv (600M monthly downloads), flat-cache, and file-entry-cache, on August 4, 2026, spreading in under four hours and e…