ChainDrop compromise spreads across more than 400 npm packages

Microsoft reported on 4 August a supply-chain compromise affecting more than 400 npm packages across unrelated publishers. The malicious releases carried a credential-stealing, self-propagating payload that generally ran before package installation completed. Researchers linked the code to a Mini Shai-Hulud variant.

The payload searched development and build environments for publishing, repository, cloud and infrastructure credentials. It could then use a recovered npm identity to alter and republish packages available to that account. That mechanism makes one exposed publishing token a potential route into other dependency chains. The package count reflects Microsoft’s described investigation. Restoring one release does not by itself show that every credential available during execution remains trustworthy.