ChainDrop Worm Steals Your Keys the Moment You Run npm Install

A worm dumped 1,300 stashes of stolen developer keys into public GitHub repos in a day. You ran npm install . That was all. The poison sat in a library npm hands out 153 million times a week . 🧐 There was no phishing email and nothing suspicious to download. You typed npm install , or your build server did it at three in the morning while you slept, and attacker code ran before the install had…