ChainDrop attack compromised more than 1,300 popular npm packages

Self-propagating ChainDrop malware compromised more than 1,300 packages on the npm registry, with a combined total of approximately 2 billion monthly downloads. The attack began after the GitHub account of Keyv’s maintainer was compromised and spread to other packages.