Skip to content

Sam's News — email-security — 2026-08-05

TL;DR

Security

ChainDrop supply chain attack compromises over 400 npm packages

A self-propagating worm dubbed ChainDrop infected over 400 npm packages by hijacking a compromised maintainer account, then automatically re-poisoned hundreds more packages to steal developer credentials across major cloud and CI tools.

  • 2,200+ malicious versions across 440 npm packages published
  • Started from 11 malware carriers in keyv/cacheable namespaces via compromised GitHub account
  • Combined weekly downloads of affected packages exceed 500 million
  • Steals npm, GitHub, AWS, Kubernetes and HashiCorp Vault credentials
  • Uses stolen npm tokens to auto-republish infected package versions
  • Exfiltrated data encrypted and sent via attacker HTTPS endpoint, with GitHub repos as fallback

Sources: SecurityWeek Research, Microsoft Security Blog Research

Microsoft 365 users targeted by Greatness phishing service spoofing RingCentral

The Greatness phishing-as-a-service platform has expanded attacks on Microsoft 365 users using RingCentral email spoofing and device code phishing techniques.

Sources: TechRadar RSS, BleepingComputer RSS