Stardrop Supply Chain Attack Targets Venture Capital Firms, Luxury Brands, and AI Companies

OpenSourceMalware uncovered a large npm-based supply-chain campaign named "Stardrop" that has published over 200 malicious packages impersonating an AI coding agent; the packages use npm optionalDependencies and postinstall scripts to install platform-specific binary payloads that act as infostealers—harvesting OpenAI/Anthropic API keys, cloud credentials, and other sensitive data. Although npm removed many packages quickly, global CDNs and mirrors still serve them, and analysts recovered Windows, macOS, and Linux binaries demonstrating credential harvesting, cloud metadata access, and stealthy deployment.