ChainDrop worm crawls into npm supply chain, evades standard defenses

Reports

3

Domains carrying it

3

First reported

5 August 2026

Latest report

17 August 2026

◆ Sectors

◆ Where

United States

◆ Timeline

1. 5 August 2026Over 400 NPM Packages Infected in ChainDrop Supply Chain Attacksecurityweek.com
2. 15 August 2026ChainDrop worm crawls into npm supply chain, evades standard defensestheregister.com
3. 17 August 2026ChainDrop npm Worm Hijacks GitHub Actions OIDC to Poison 444 Packages With Valid ...cyberpress.org

◆ Connected developments

Situations Wire finds semantically close to this one. Proximity, not cause.

• Chainalysis sues U.S. over $94.7M TRM Labs contract3 reports · 3 domains · 30 August 2026
• More than 200 victims of Medusa ransomware identified over the last year, CISA says11 reports · 11 domains · 25 August 2026
• Gunra Ransomware Targets Governments and Critical Infrastructure2 reports · 2 domains · 12 August 2026
• Anthropic AI Models Hacked 3 Organisations During Cybersecurity Tests14 reports · 13 domains · 11 August 2026
• TP-Link Zero-Touch Provisioning Flaws Could Expose Enterprise Networks, Warns Forescout2 reports · 2 domains · 7 August 2026
• Hack of water sector supplier draws FBI scrutiny as Iran-linked cyber concerns grow3 reports · 3 domains · 27 August 2026

◆ Share

◆ Evidence

3 reports · 3 domains

• ChainDrop npm Worm Hijacks GitHub Actions OIDC to Poison 444 Packages With Valid ...cyberpress.org · 17 August 2026
• ChainDrop worm crawls into npm supply chain, evades standard defensestheregister.com · 15 August 2026
• Over 400 NPM Packages Infected in ChainDrop Supply Chain Attacksecurityweek.com · 5 August 2026