MEDIUMSupply Chain
Global

ChainDrop Worm Hits 400+ npm Packages with Two Billion Monthly Installs

·Source: Infosecurity Magazine

Updated:

Executive Summary

A new npm worm has compromised packages with over two billion monthly installs

Analysis

A new npm worm has compromised packages with over two billion monthly installs
Source Attribution

Originally published by Infosecurity Magazine on Aug 5, 2026.

Related Threats

MEDIUMSupply Chain

Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack

The malware was designed to steal and exfiltrate secrets, and to propagate itself via stolen NPM and GitHub credentials. The post Over 400 NPM Packages Infected in ChainDrop Supply Chain Attack appeared first on SecurityWeek .

SecurityWeek
CRITICALSupply Chain

AI threat report: Rogue agents, workflow attacks

Malicious AI use and threats to AI systems are requiring cyber teams to double down on security fundamentals and rethink the future of their approaches to defense. Newly emerging AI-enabled attacks, proofs of concept, and in-the-wild techniques, as well as the latest AI vulnerability and risk research, present inklings not only about what enterprises presently face but also how security leaders ne

CSO Online
MEDIUMSupply Chain

QuickFox Supply Chain Attack Delivers FDMTP Backdoor via Trojanized Windows Installer

Cybersecurity researchers have disclosed what has been described as a "long-standing supply chain attack" on QuickFox, a virtual private network (VPN) and network acceleration tool designed for overseas Chinese users. According to Fortinet FortiGuard Labs, the supply chain attack has been ongoing since at least August 2025 and involves a trojanized version of the application to deliver FDMTP, a

The Hacker News