Connecting the Dots: Securing the Overlooked Corners of the Software Development Lifecycle (SDLC) Supply Chain

The article details the ChainDrop npm worm, a self-propagating supply chain attack that infected over 400 npm packages, including popular libraries like keyv and cacheable-request. It leverages malicious preinstall scripts to download an obfuscated payload, steals cloud secrets from CI/CD environments (including GitHub Actions OIDC tokens), backdoors local developer tools such as VS Code, and uses stolen tokens to automatically propagate. The malware maintains persistence through integration with developer tools and uses Ethereum blockchain for dynamic command-and-control infrastructure, highlighting the expanding threat surface in the software development lifecycle.

AI-extracted · verify before operational use