🤖 ChainDrop: massive npm supply-chain attack. Worm compromised 1,300+ packages (~2B monthly downloads) after hijacking the Keyv maintainer's GitHub account; releases kept valid provenance via legit GitHub Actions. setup.mjs auto-runs on npm install and deploys a Bun-based infostealer. 🔗 https://www.bleepingcomputer.com/news/security/massive-chaindrop-npm-supply-chain-attack-infects-hundreds-of-packages/ #SupplyChain #npm #Malware #InfoSec