ChainDrop worm crawls into npm supply chain, evades standard defenses
A new worm variant, ChainDrop (also called Shai-Hulud), has infected 444 npm packages, spreading via tarballs and developer tool hooks while evading standard security defenses.
A new supply-chain worm, ChainDrop (a Shai-Hulud variant), has infected 444 npm packages. It evades standard defenses by spreading via tarballs and exploiting development-tool hooks, poisoning the software supply chain.