Shai Hulud

A self-propagating npm worm called ChainDrop compromised 444 packages, including keyv (600M monthly downloads), flat-cache, and file-entry-cache, on August 4, 2026, spreading in under four hours and e…

A security researcher disclosed a design flaw in GitHub's commit verification system that allows attackers to spoof verified commits by exploiting a mismatch between the author and committer fields. G…