ChainDrop credential stealing worm infects over 400 npm packages
Summary
A worm-like attack dubbed ChainDrop has infected over 400 npm packages, impacting billions of monthly downloads. The attack began with a compromised GitHub account, leading to the distribution of credential-stealing malware that uses the Ethereum blockchain for command and control.
IFF Assessment
This article details a widespread supply chain attack that has compromised a significant number of popular software packages, posing a direct threat to developers and organizations relying on the npm ecosystem.
Defender Context
This incident highlights the severe risks associated with supply chain attacks targeting software repositories like npm. Defenders should be vigilant about the security of their dependencies, implement robust code scanning and vulnerability management, and consider using tools that can detect malicious code within pre-install scripts.