ChainDrop supply chain compromise: Anatomy of a self-propagating worm

Microsoft Security Blog RSS items describe a self-propagating supply-chain worm hidden in more than 400 compromised npm packages, credential theft and malware delivery by Midnight Blizzard, ransomware disruption, phishing trends, and guidance for securing AI and DevSecOps environments. The most significant threat is ChainDrop, which automatically republishes malicious package updates across software ecosystems and may enable broad downstream compromise. No CVE identifiers are provided in the source.