ChainDrop npm Worm Hijacks GitHub Actions OIDC to Poison 444 Packages With Valid ...

The ChainDrop campaign compromised 444 npm packages by hijacking GitHub Actions OIDC using stolen credentials, pushing malicious configuration files that execute malware without needing to install dependencies.

This Wire brief sits within Fusion42's coverage of Developer Tools and Cybersecurity. Wire is Fusion42's founder-focused intelligence feed: each story is connected to the funds and startups it names — every one with a live profile on Raise or Scout — so founders can follow the capital and the momentum behind the headline rather than just the headline itself. Wire analysis is one of the live surfaces Arthur reasons over.