New npm worm ChainDrop appears to be having a great time in the ecosystem right now www.stepsecurity.io/blog/chaindr... socket.dev/blog/popular... safedep.io/keyv-npm-sup...
ChainDrop npm Worm: Bun-loaded CI/CD credential harvester with Ethereum dead-drop C2 - StepSecurityA self-propagating worm is publishing compromised versions of dozens of npm packages using stolen maintainer credentials. See the affected packages and what to do now.www.stepsecurity.io