Insights, news, education and announcements from PolySwarm | npm malware

Self-Propagating ChainDrop Worm Infects More Than 400 npm Packages in Major Software Supply Chain Attack

Aug 10, 2026, 3:15:02 PM / by The Hivemind posted in Threat Bulletin, npm malware, Software Supply Chain Security, Mini Shai-Hulud, JavaScript malware, GitHub Actions OIDC, npm supply chain attack

Related Families: Mini Shai-Hulud, ChainDrop

Executive Summary

Industry researchers identified a large-scale software supply chain attack involving more than 400 compromised npm packages distributed across multiple unrelated publishers. The campaign delivers a new variant of the Mini Shai-Hulud malware, dubbed ChainDrop, through malicious preinstall lifecycle scripts, enabling credential theft, cloud and infrastructure enumeration, repository compromise, and automated propagation using stolen npm publishing credentials. By targeting both developer workstations and CI/CD environments, the campaign demonstrates how modern software supply chain attacks increasingly leverage trusted developer identities to compromise downstream software ecosystems.

Read More

The Axios Breach: When npm Trust Becomes an APT Attack Vector

Apr 6, 2026, 2:36:03 PM / by The Hivemind posted in Threat Bulletin, North Korean threat actors, UNC1069, CI/CD compromise, npm malware, supply chain attacks, Axios npm compromise, WAVESHAPER, DPRK cyber operations, RAT malware

Verticals Targeted: Software, Technology, Cloud, Enterprise IT environments
Regions Targeted: Global
Related Families: WAVESHAPER.V2

Executive Summary

A supply chain compromise of the widely used Axios npm package introduced a malicious dependency delivering cross-platform remote access trojans, now linked with high confidence to a North Korea–aligned threat cluster UNC1069. The campaign leveraged maintainer account takeover, npm publishing abuse, and install-time execution to target developer environments and CI/CD pipelines during a short but high-risk exposure window.

Read More

Infect Once, Spread Everywhere: CanisterWorm and the Automation of Supply Chain Compromise

Mar 31, 2026, 11:07:10 AM / by The Hivemind posted in Threat Bulletin, DevSecOps security, decentralized C2, ICP malware, CanisterWorm, CI/CD compromise, Kubernetes security, software supply chain attack, npm malware, TeamPCP, container security, token harvesting malware

Related Families: CanisterWorm

Read More