Supply Chain26 Sept 2026·3 sources
ChainDrop: Self-Propagating npm Worm Compromises 400+ Packages Starting From keyv
Elastic Security Labs and Microsoft have published analyses of ChainDrop, a self-propagating npm worm that Elastic identified on 4 August 2026 and that compromised more than 400 packages, starting with the trojanised keyv monorepo. Unit 42 later cited it as an example of SDLC supply-chain risk.
ChainDropnpmsupply-chain+2
