https://hackingpassion.com/tags/chaindrop/Recent content in ChainDrop on HackingPassion.com : root@HackingPassion.com-[~]HugoenWed, 05 Aug 2026 12:24:22 +0200https://hackingpassion.com/chaindrop-npm-worm-keyv/Wed, 05 Aug 2026 12:24:22 +0200https://hackingpassion.com/chaindrop-npm-worm-keyv/<p>A worm dumped 1,300 stashes of stolen developer keys into public GitHub repos in a day. You ran <code>npm install</code>. That was all. The poison sat in a library npm hands out <strong>153 million times a week</strong>. 🧐</p> <p>There was no phishing email and nothing suspicious to download. You typed <code>npm install</code>, or your build server did it at three in the morning while you slept, and attacker code ran before the install had finished.</p>