ChainDrop

ChainDrop worm crawls into npm supply chain, evades standard defenses - The Register

A malicious JavaScript package named 'ChainDrop' infiltrated the npm public registry, using obfuscation and multi-stage execution to bypass conventional security scanners and compromise developer environments.