THREAT OPS › Threat News › ChainDrop supply chain compromise: Anatomy of a self-propagating worm
ChainDrop supply chain compromise: Anatomy of a self-propagating worm
<aside class="table-of-contents-block accordion wp-block-bloginabox-theme-table-of-contents" id="accordion-e9dd2854-91ec-475c-9d7f-7b72148b2a28"> <button class="btn btn-collapse" type="button"> <span class="table-of-contents-block__label">In this article</span> <span class="table-of-contents-block__current"></span>
<svg class="table-of-contents-block__arrow" fill="none" height="11" viewBox
MITRE ATT&CK techniques
Indicators of compromise
- 54dc7ea54a1317cca0e890a2770630cf7fa6c97813e0cb9d2caa93012b350668sha256
- fd3ca4007b225fdf8de7af4345a19179d5efa8c4bb9205f88cda806e5684b1ebsha256
- 9fc2570b7cef51c1b8df116d144d11ff4096357be7d2c4c6367cfc2509cf1bccsha256
- 0xE1f2395ee43e45A1556EC6438a88c31B83493103eth
- https://github.blog/changelog/2026-02-18-npm-bulk-trusted-publishing-config-and-script-security-now-generally-available/url
- https://docs.npmjs.com/cli/v11/using-npm/configurl
- https://npm-cache.com:443/routerurl
- https://microsoft.github.io/zerotrustassessment/url
- pypi-get.comdomain
- js-mirror.comdomain
Original source: https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/
Same event, other sources
- ChainDrop: Inside a Self-Propagating npm Wormunit42 · 2026-08-06