[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fCSuDavakOXm-_6DK3Qi8TMwrmqBt2P1-HhQYuHX6yVY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":22,"status":23,"created_at":24,"published_at":25,"article":26,"tags":30,"podcasts":49,"controls":56},"4472df45-c51d-4b54-8f75-d53010bfed2a","chaindrop-poisons-400-npm-packages-to-steal-dev-credentials","5fd24eec-344e-45d1-b899-8eb80b1c561a","ChainDrop Poisons 400+ NPM Packages to Steal Dev Credentials","The ChainDrop attack exploited the trust developers place in open-source package ecosystems by injecting malware into over 400 NPM packages across 2,200+ malicious versions. Once installed, the malware harvested NPM and GitHub tokens, enabling attackers to self-propagate by publishing further poisoned packages and compromising repositories in a cascading effect. CI\u002FCD pipelines and cloud secrets were also targeted, meaning a single infected dependency could expose an entire production infrastructure. This attack illustrates how stolen developer credentials can become a force multiplier, turning one compromised package into an organization-wide breach.","**Immediate actions:**\n- Audit all NPM dependencies in active projects against the known ChainDrop indicator-of-compromise list and remove or pin affected versions immediately.\n- Rotate all NPM tokens, GitHub personal access tokens, and cloud credentials that may have been exposed in affected environments.\n- Scan CI\u002FCD pipeline configurations for unauthorized secret access or unexpected outbound network calls.\n\n**Long-term improvements:**\n- Enforce least-privilege scoping on all NPM publish tokens and GitHub Actions secrets so compromised credentials have minimal blast radius.\n- Implement a private package registry or dependency proxy (e.g., Artifactory, Verdaccio) to vet and cache approved package versions before they reach developer environments.\n- Adopt a software bill of materials (SBOM) process to maintain full visibility into every third-party dependency used across your software supply chain.\n\n**Detection measures:**\n- Enable real-time alerting on unexpected NPM publish events or new package versions from your organization's namespaces.\n- Deploy runtime secret-scanning tools in CI\u002FCD pipelines to detect and block credential exfiltration attempts before build artifacts are published.\n- Monitor outbound network traffic from build agents for anomalous connections to unknown external endpoints.",[12,13,14,15,16,17,18,19,20,21],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 16: Application Software Security","NIST SP 800-161r1: Cybersecurity Supply Chain Risk Management","NIST SP 800-53 SA-12: Supply Chain Protection","NIST SP 800-53 AC-6: Least Privilege","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","SLSA Framework Level 2+: Build Integrity and Provenance","OpenSSF Scorecard: Dependency and Token Security Best Practices","GDPR Article 32: Security of Processing (for organizations handling EU personal data via affected pipelines)",{},"published","2026-08-05T10:21:03.897392+00:00","2026-08-05T10:21:03.733+00:00",{"id":7,"url":27,"slug":28,"title":29},"https:\u002F\u002Fwww.securityweek.com\u002Fover-400-npm-packages-infected-in-chaindrop-supply-chain-attack\u002F","over-400-npm-packages-infected-in-chaindrop-supply-chain-attack-79cdb2","Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack",[31,37,43],{"id":32,"name":33,"slug":34,"description":35,"color":36},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":38,"name":39,"slug":40,"description":41,"color":42},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":44,"name":45,"slug":46,"description":47,"color":48},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[50],{"id":51,"date":52,"edition":53,"title":54,"audio_url":55},"d978475b-09bc-4312-b1a4-d7d4a6f7d662","2026-08-05","afternoon","ThreatNoir Afternoon Brief — August 5","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-05\u002Fthreatnoir-afternoon-brief-2026-08-05.mp3",[57,61,65],{"slug":58,"name":59,"problem":60},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",{"slug":62,"name":63,"problem":64},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":66,"name":67,"problem":68},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]