ChainDrop worm hits 1,300+ npm packages

Aikido researchers uncovered ChainDrop, a Shai-Hulud variant infecting over 1,300 npm packages with an infostealer. Attackers compromised GitHub accounts tied to Keyv, Cacheable, flat-cache, and file-entry-cache, pushing tainted releases with 2B monthly downloads. Malware exfiltrates credentials to a public GitHub repo; admins should treat systems as compromised.