Cyber security ChainDrop npm worm hits 1,300 packages, steals cloud secrets ChainDrop is a self-propagating npm worm that hit 1,300 packages with 2 billion monthly downloads, stealing cloud credentials from CI/CD runners. Lars Cornelissen · Aug 5, 2026