ChainDrop worm hijacks 444 npm packages, exposing 2 billion downloads
On Aug 4 2026 a self‑propagating worm dubbed ChainDrop injected malicious preinstall scripts into 444 npm packages—2,212 versions—representing over 2 billion monthly downloads. The payload drops the Bun runtime, exfiltrates CI and cloud credentials, and communicates via an Ethereum‑based C2, enabling rapid republishing of poisoned packages.