[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fc4SsMuQIBcyMVrjMIBfSdq67iuQcWeTkU8u4LLgyF1Q":3},{"article":4,"iocs":55,"watch_terms":66,"solutions":67,"lesson":156},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"5fd24eec-344e-45d1-b899-8eb80b1c561a","Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack","over-400-npm-packages-infected-in-chaindrop-supply-chain-attack-79cdb2","The malware was designed to steal and exfiltrate secrets, and to propagate itself via stolen NPM and GitHub credentials. The post Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack appeared first on SecurityWeek.","A supply chain attack dubbed ChainDrop has compromised over 400 NPM packages, publishing more than 2,200 malicious versions. The malware steals various credentials, including NPM and GitHub tokens, and uses them to propagate further by publishing poisoned package versions and infecting repositories. It also targets CI\u002FCD environments and cloud infrastructure secrets.","ChainDrop attack infects over 400 NPM packages with malware to steal secrets.","https:\u002F\u002Fwww.securityweek.com\u002Fover-400-npm-packages-infected-in-chaindrop-supply-chain-attack\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2024\u002F12\u002Fblockchain-cryptocurrency-Solana.jpeg","2026-08-05T08:56:58+00:00","2026-08-05T10:00:26.283967+00:00",9,[17,20,22,25,28,30],{"name":18,"type":19},"NPM","product",{"name":21,"type":19},"GitHub",{"name":23,"type":24},"CI\u002FCD","technology",{"name":26,"type":27},"Microsoft","vendor",{"name":29,"type":27},"JFrog",{"name":31,"type":27},"StepSecurity","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,40,45,50],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,59,62],{"type":44,"value":57,"context":58},"Mini Shai-Hulud","Name of the malware campaign and its evolved descendant",{"type":44,"value":60,"context":61},"ChainDrop","Name of the supply chain attack campaign",{"type":63,"value":64,"context":65},"url","https:\u002F\u002Fgithub.com\u002FShai-Hulud\u002FShai-Hulud","Attacker-created public GitHub repository used for exfiltration",[26,29,31],{"controls":68,"vendors":146},[69,98,126],{"slug":70,"name":71,"problem":72,"products":73},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[74,82,90],{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":99,"name":100,"problem":101,"products":102},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[103,111,118],{"vendor_slug":104,"vendor_name":105,"vendor_logo":106,"product_slug":107,"product_name":108,"url":109,"description":110},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":112,"vendor_name":21,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"github","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"slug":127,"name":128,"problem":129,"products":130},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[131,137,145],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":132,"product_name":133,"url":135,"description":136},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":141,"product_name":142,"url":143,"description":144},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":112,"vendor_name":21,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},[147,152],{"slug":148,"name":29,"logo_path":149,"roles":150},"jfrog","\u002Fvendor-logos\u002Fjfrog.png",[151],"reported_by",{"slug":153,"name":26,"logo_path":154,"roles":155},"microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[151],{"slug":157,"title":158,"body":159,"framework_refs":160,"framework_notes":171},"chaindrop-poisons-400-npm-packages-to-steal-dev-credentials","ChainDrop Poisons 400+ NPM Packages to Steal Dev Credentials","The ChainDrop attack exploited the trust developers place in open-source package ecosystems by injecting malware into over 400 NPM packages across 2,200+ malicious versions. Once installed, the malware harvested NPM and GitHub tokens, enabling attackers to self-propagate by publishing further poisoned packages and compromising repositories in a cascading effect. CI\u002FCD pipelines and cloud secrets were also targeted, meaning a single infected dependency could expose an entire production infrastructure. This attack illustrates how stolen developer credentials can become a force multiplier, turning one compromised package into an organization-wide breach.",[161,162,163,164,165,166,167,168,169,170],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","SLSA Framework Level 2+: Build Integrity and Provenance","OpenSSF Scorecard: Dependency and Token Security Best Practices","GDPR Article 32: Security of Processing (for organizations handling EU personal data via affected pipelines)",{}]