{"slug": "chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses", "title": "ChainDrop worm crawls into npm supply chain, evades standard defenses", "summary": "Researchers at Phylum have identified a new npm supply chain worm, dubbed ChainDrop, that evades standard defenses by using a multi-stage attack chain. The worm spreads through malicious packages and has been observed targeting developers, potentially compromising their systems and stealing credentials.", "body_md": "### MOST POPULAR\n\n[AI](https://beta.theregister.com/tag/ai)\n\n-\nai and ml\n\n#### Anthropic says text watermarking scheme relies on inconsequential words\n\n'Shall I compare thee to a summer's afternoon' is the sort of thing this will make, and others look likely to adopt it\n\n-\nAI and ML\n\n#### DeepSeek's innovative harness treats everything as a plug-in\n\nChinese AI labs keep moving forward while US labs play defense\n\n-\nSECURITY\n\n#### Autonomous AI attacks pose 'clear and present danger' to critical infrastructure\n\nWeaponized agents could turn digital intrusions into kinetic disasters, experts warn\n\n-\noff-prem\n\n#### Rent-a-GPU outfit Nebius promises rapid 1 GW powerup plan isn't nebulous\n\nAnd it'll jump through every financial hoop it can to get there\n\n-\nAI and ML\n\n#### Modular's Mojo programming language hits 1.0 milestone\n\nDevelopers await open source compiler release to dispel uncertainty following Qualcomm acquisition\n\n[Infosec](https://beta.theregister.com/security)\n\n-\nSecurity\n\n#### Russians are posing as Signal support to launch phishing attacks\n\nPLUS: US takes down Iranian propaganda sites; Marketing company asks 'Why Do We Have Your Information?' And more!\n\n-\nSecurity\n\n#### Microsoft patches failed to fix on-prem SharePoint, which is now under zero-day attack\n\nPLUS: China upgrades smartphone surveillance tools; Ring eases anti-snooping stance; and more\n\n-\nBlack Hat and DEF CON\n\n#### DEF CON Franklin project enlists hackers to harden critical infrastructure\n\nVoting village reports have been so successful, says Jeff Moss, that the whole of DEF CON will now be included\n\n-\nSecurity\n\n#### EQT buys majority share in Swiss cybersecurity biz Acronis\n\nWent at equivalent of $3.5B+ valuation for entire firm, though portion sold not specified\n\n-\nMalware Month\n\n#### Ten years since the first corp ransomware, Mikko Hyppönen sees no end in sight\n\nOn the plus side, infosec's a good bet for a long, stable career\n\n[FOSS](https://beta.theregister.com/tag/FOSS)\n\n-\n#### FOSS smashed one Microsoft monopoly. After 20 years of failure, it's time to smash another\n\nWord up\n\n-\n#### GNOME can look like Windows – and Flashback can do it without extensions\n\nNew 'Simple-taskbar' is an option, but there's a simpler, stabler way\n\n-\n#### A moment of silence, please, for the final release of Debian on x86-32\n\nNew Debian versions hit FOSSland in the form of 13.6 and 12.15\n\n-\n#### Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websites\n\nFlaws in iCagenda, Balbooa Forms extensions can impact open source CMS that powers a million sites worldwide\n\n-\n#### Frame: A new X11 server – implemented directly in assembly\n\nJoins yserver, Phoenix, and of course XLibre – and outlier Arcan\n\n-\n#### Cinnamon 6.8 will support Wayland – if you want it\n\nNext version of Linux Mint’s desktop has both kinds of display server", "url": "https://wpnews.pro/news/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses", "canonical_source": "https://www.theregister.com/security/2026/08/15/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses/5287958", "published_at": "2026-08-15 10:31:00+00:00", "updated_at": "2026-08-15 23:11:08.777907+00:00", "lang": "en", "topics": ["ai-safety"], "entities": ["Phylum", "ChainDrop", "npm"], "alternates": {"html": "https://wpnews.pro/news/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses", "markdown": "https://wpnews.pro/news/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses.md", "text": "https://wpnews.pro/news/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses.txt", "jsonld": "https://wpnews.pro/news/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses.jsonld"}}