EdgeProtect
Threat News
Latest cyber threat intelligence, breaches and exploitation
2 matching stories
Supply-ChainChainDrop: Self-Propagating npm Worm Compromises 400+ Packages Starting From keyv
Elastic Security Labs and Microsoft have published analyses of ChainDrop, a self-propagating npm worm that Elastic identified on 4 August 2026 and that compromised more than 400 packages, starting with the trojanised keyv monorepo. Unit 42 later cited it as an example of SDLC supply-chain risk.
TeamPCP Added Malware to 42 Microsoft-Linked GitHub Repositories in June
On 5 June 2026 TeamPCP used a compromised GitHub account to inject malicious code into at least 42 repositories and 236 branches in the Azure, Azure-Samples and Microsoft GitHub organisations, according to Wiz. The incident followed the group's earlier supply-chain compromises of Trivy, Checkmarx, LiteLLM and BerriAI and its Mini Shai-Hulud npm and PyPI campaign.
