Wire · opportunities
ChainDrop npm Worm Hijacks GitHub Actions OIDC to Poison 444 Packages With Valid ...
◆ Sectors
◆ Geography
◆ Source
◆ Verified
Fusion42 · 17 August 2026 · Fusion42 review
The ChainDrop campaign compromised 444 npm packages by hijacking GitHub Actions OIDC using stolen credentials, pushing malicious configuration files that execute malware without needing to install dependencies.
This Wire brief sits within Fusion42's coverage of Developer Tools and Cybersecurity, and 3 sources have reported it between 5 Aug 2026 and 17 Aug 2026.
◆ ◆ The Wire takeaway
ChainDrop shows how trusted developer tools can be weaponised to bypass traditional npm security checks and infect your developer machines without running installs. You must audit repository config files, not just dependencies, to block this new malware vector.
◆ Coverage
3 sources · first reported 5 Aug 2026 · latest 17 Aug 2026
◆ Related on Wire
◆ Topics