Massive ChainDrop npm supply-chain attack infects hundreds of packages
BleepingComputer reports a massive npm supply-chain attack named ChainDrop that has infected hundreds of packages. The attack leverages the npm ecosystem, a widely used package manager for JavaScript, to distribute malicious code. By compromising these packages, the attackers can potentially inject harmful code into applications that depend on them, affecting developers and organizations that use these packages in their projects. The report highlights the scale of the attack, with hundreds of packages affected, underscoring the severity of the supply-chain compromise. The incident is ongoing, and the security community is working to understand the full extent of the damage and mitigate the risks. The attack is notable for its scale and the potential downstream impact on software development projects that rely on these packages.
Hundreds of npm packages are compromised, putting developers' projects at risk of malicious code injection.