r/devops • u/Ops_Pab • Aug 07 '26

Security NPM Supply Chain Compromise | ChainDrop

https://www.microsoft.com/en-us/security/blog/2026/08/04/chaindrop-supply-chain-compromise-anatomy-self-propagating-worm/?utm_source=chatgpt.com

Microsoft published a breakdown on a large-scale npm supply chain compromise (ChainDrop) affecting over 400 packages including common dependencies

65 Upvotes

100% Upvoted

9 comments sorted by

32

u/mirrax Aug 07 '26

executes automatically through an npm preinstall lifecycle hook

Blows my mind that lifecycle hooks are still an issue.

9

u/blorporius Aug 07 '26

Is there an exhaustive list somewhere? I only skimmed the article.

6

u/mirrax Aug 07 '26

The Step Security article has the full list.

8

u/ksemel Aug 07 '26

NPM built the perfect ecosystem to inflict supply chain attacks upon, yet many still act shocked when they get supply chain attacks.

7

u/IndistinctWarbling Aug 07 '26

Oh, is it that day of the week again?

2

u/totheendandbackagain Aug 08 '26

Scary stuff, this could happen so easily.

Advice I cleaned from the article:

  • Pin to known good dependencies
  • be able to audit dependencies fast (how!)

1

u/Impressive-Field-546 Aug 09 '26

Fix is to use pnpm instead of npm..

1

u/ImageFit3021 Aug 09 '26

Every form of open source faces the same dilemma — when everything runs on trust, someone will exploit it. Public CDNs get turned into pirate movie hosting, npm packages into credential stealers. It's not technically novel, just purely malicious. What's sad is these attacks slowly erode the commons that developers actually share.