Shai-Hulud npm worm variant 'ChainDrop' poisons 444 packages
Story essentials
ChainDrop malware operators
Global (npm ecosystem)
August 4, 2026
This page is produced by collecting and structuring multiple public reports. Sections based only on reporting or testimony affect the displayed assessment, and the page is updated when new information is identified.
About this article
COMPAMIR Editorial Team
The COMPAMIR editorial team brings together public reporting and links to the original coverage. We update the page as new information emerges.
Read our editorial policy- Earlier version 18/15/2026, 11:50:22 PM
A new Shai-Hulud variant named 'ChainDrop' has infected 444 npm packages. The malware spreads via tarballs and injects startup hooks into repository configurations. It targets npm tokens, GitHub credentials, and environment variables to exfiltrate data. Infection can occur simply by opening a compromised Git branch in VS Code or Claude Code.
Read next
Prioritized by shared people, places, and events.
Microsoft email service outage resolved globally
Microsoft email services, specifically Exchange Online, were restored on Nov 14 after a major outage. The disruption began around 5:25 pm GMT on Nov 12 and affected hundreds of thousands of users globally. Microsoft confirmed the issue was caused by a network capacity upgrade, not a cyberattack or AI agents. Singaporean government agencies and major banks were among those affected.