ChainDrop supply chain compromise: Anatomy of a self-propagating worm

Microsoft Threat Intelligence describes a large-scale npm supply-chain campaign in which a heavily obfuscated Bun-based JavaScript worm (Mini Shai-Hulud variant) was distributed in malicious package releases across 400+ otherwise unrelated npm packages. The payload executes via npm preinstall hooks on developer workstations and CI/CD runners, harvests npm/GitHub/cloud credentials, exfiltrates encrypted data to attacker-controlled endpoints (with GitHub-based fallback), and propagates by using stolen npm tokens and GitHub credentials to republish compromised packages and inject persistence into repositories and developer tooling; Microsoft provides detection, mitigation, IOC lists, and hunting queries.