ChainDrop: Inside a Self-Propagating npm Worm
LowUnit 42 · Unit 42·
Analysis of ChainDrop, an npm supply chain worm extracting GitHub Actions runner secrets and using Ethereum smart contracts for C2 routing. The post ChainDrop: Inside a Self-Propagating npm Worm appeared first on Unit 42 .
Read the full story at unit42.paloaltonetworks.com ↗Established Source
We summarise and link; this source is not one we hold a licence to reproduce. Everything below is what NexaPulse adds: the vulnerabilities involved, whether they are being exploited, who is named, and who else covered it.
At a glance
- Severity
- Lowfrom category and source signals; no CVSS referenced
- Exploitation
- No vulnerabilities referenced
- Vulnerabilities
- None referenced
- Vendors & products
- GitHub
- Threat actors & malware
- None named
- Industries
- Not industry-specific
- Coverage
- 1 outlet· first seen 2026-08-06 22:26 UTC
- Priority
- 22/100Source tier, category, exploitation and corroboration. Not a risk score for your environment.
Coverage
One outlet has carried this so far.
2026-08-06 22:26 UTC
Related stories
- OpenAI Agents Linked to RubyGems Campaign That Gained RCE on RubyDoc Servers
The Hacker News · 2026-09-12
- AI Hallucinations Trigger Malware Flag on 1M+ Active User Extension
Hacker News · 2026-09-12
- Researchers say OpenAI agents were behind May hacking campaign targeting RubyGems
CyberScoop · 2026-09-12
- Threat Actor Generates 1M Personalized Fraud Emails in 3 Days
Dark Reading · 2026-09-11
- Microsoft sees some new wrinkles in invoice-scam emails
The Record · 2026-09-11