New ChainDrop worm poisons over 1,300 npm packages, Keyv and Cacheable among those hit

Another Shai-Hulud variant hits npm packages, worming its way into hundreds of packages.

Massive ChainDrop npm supply-chain attack infects hundreds of packages

Self-propagating malware named 'ChainDrop' has compromised more than 1,300 packages with a combined 2 billion monthly ...
SecurityWeek

Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack

More than 400 NPM packages have been infected with the Mini Shai-Hulud worm in the ChainDrop supply chain attack.
Tech Times on MSN

BSides Las Vegas AI track warned of agentic worm risk the day before ChainDrop hit

BSides Las Vegas 2026 spent three days making the case that AI coding tools are supply chain attack targets. ChainDrop, a ...
Arabian Post

ChainDrop worm spreads across hundreds of npm packages

A self-propagating malware campaign has compromised more than 430 npm packages, exposing software projects linked to dependencies that collectively record about two billion installations each month.
Infosecurity Magazine

ChainDrop Worm Hits 400+ npm Packages with Two Billion Monthly Installs

Security researchers have warned of a major new Shai-Hulud-based campaign which has already compromised more than 430 ...
The Next Web

A worm tore through npm by making the malware look perfectly legitimate

A self-spreading worm poisoned hundreds of npm packages in hours, slipped past provenance checks, hid its controls on Ethereum, and hunted AI-tool keys.
Microsoft

ChainDrop supply chain compromise: Anatomy of a self-propagating worm

A credential-stealing worm hidden in more than 400 compromised npm packages automatically spread across software ecosystems ...
CSO Online

ChainDrop credential stealing worm infects over 400 npm packages

The Shai Hulud variant’s blast radius includes several highly popular packages thus far.. Security teams are urged to perform ...