ChainDrop worm crawls into npm supply chain, evades standard defenses

A new Shai-Hulud variant named ChainDrop has been observed in a large npm supply-chain campaign that poisoned 444 packages (collectively downloaded ~2 billion times/month). It stealthily propagates by modifying tarballs and inserting startup hooks into repository configuration (e.g., .claude/settings.json, .vscode/tasks.json), harvests npm tokens, cloud keys and secrets, exfiltrates data to attacker-controlled endpoints, and can commit malicious config to accessible GitHub branches to spread further; affected packages were removed from npm and vendors published lists of compromised packages and versions.