[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMaZsPI2oPuK5kW-7E669X3n1SNrgcpGyoWM5qaz4C8Y":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":57},"b9e1473f-b8f5-4ecc-b36a-e5bf78446574","chaindrop-self-propagating-worm-hijacks-400-npm-packages-via-stolen-credentials","48c3fd36-1315-49fd-821b-6bea4a280d7a","ChainDrop: Self-Propagating Worm Hijacks 400+ npm Packages via Stolen Credentials","The ChainDrop attack exploited npm's preinstall lifecycle hook to silently execute malicious JavaScript during routine package installations, targeting developer workstations and CI\u002FCD pipelines. Once credentials for npm, GitHub, and AWS were harvested, the worm autonomously republished infected versions of legitimate packages, creating a self-sustaining propagation loop across the open-source ecosystem. This attack is particularly dangerous because developers and automated pipelines implicitly trust packages from well-known registries, meaning a single compromised dependency can cascade into hundreds of downstream victims. The use of long-lived, overly permissive credentials stored in developer environments amplified the blast radius significantly. This incident underscores that supply chain integrity is only as strong as the least-secured credential in the development pipeline.","**Immediate actions:**\n- Audit all npm packages in use and cross-reference against the list of 400+ known-compromised ChainDrop packages using tools like `npm audit` or Socket.dev.\n- Rotate all npm, GitHub, and AWS credentials stored on developer workstations and in CI\u002FCD environment variables immediately.\n- Disable or sandbox npm lifecycle hooks (preinstall, postinstall) in CI\u002FCD pipelines using `npm ci --ignore-scripts` where possible.\n\n**Long-term improvements:**\n- Enforce least-privilege, short-lived credentials (e.g., OIDC tokens) for all CI\u002FCD pipeline interactions with cloud and registry services.\n- Implement a private, internally mirrored package registry with allowlisting to control which third-party packages can be consumed.\n- Adopt a Software Bill of Materials (SBOM) process to continuously track and verify the integrity of all open-source dependencies.\n\n**Detection measures:**\n- Deploy runtime monitoring in CI\u002FCD environments to alert on unexpected outbound network calls or credential-file access during package installation.\n- Integrate software composition analysis (SCA) tools such as Dependency-Track or Snyk into every pipeline to flag newly flagged malicious packages before build completion.\n- Enable npm registry publish event alerts and audit logs to detect unauthorized republication of packages under your organization's namespaces.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 6: Access Control Management","CIS Control 16: Application Software Security","NIST SP 800-161: Cybersecurity Supply Chain Risk Management","NIST SP 800-218: Secure Software Development Framework (SSDF) PW.4, RV.1","NIST AC-6: Least Privilege","NIST SI-3: Malicious Code Protection","NIST SR-11: Component Authenticity","SLSA Supply Chain Levels for Software Artifacts (Level 3+): Build Integrity","OWASP A06:2021 – Vulnerable and Outdated Components","GDPR Article 32: Security of Processing (for EU-regulated organizations handling personal data in affected pipelines)",{},"published","2026-08-05T02:20:22.624299+00:00","2026-08-05T02:20:22.496+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fblog\u002F2026\u002F08\u002F04\u002Fchaindrop-supply-chain-compromise-anatomy-self-propagating-worm\u002F","chaindrop-supply-chain-compromise-anatomy-of-a-self-propagating-worm-7e48a2","ChainDrop supply chain compromise: Anatomy of a self-propagating worm",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"05757c8d-6b93-4194-b35d-7359e7d33b0e","Vulnerability Management","vulnerability-management","Missing scans, no risk prioritization","#fb923c",{"id":39,"name":40,"slug":41,"description":42,"color":43},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[51],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"81aaeaa7-e77a-4384-8eb5-4bdfde9b4955","2026-08-05","morning","ThreatNoir Morning Brief — August 5","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-08-05\u002Fthreatnoir-morning-brief-2026-08-05.mp3",[58,62,66],{"slug":59,"name":60,"problem":61},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":63,"name":64,"problem":65},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":67,"name":68,"problem":69},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]