Worm

ChainDrop worm spreads through hundreds of npm packages, stealing CI/CD secrets

A self-propagating worm compromised hundreds of popular npm packages, harvesting cloud keys and CI tokens then using them to publish further poisoned releases.