ChainDrop npm worm reads its C2 from an Ethereum contract - and scrapes CI runner memory for OIDC tokens. https://intel.threadlinqs.com/threat/TL-2026-3214 #ThreatIntel #DEVPOPPER #ShaiHulud #BeaverTail
Explore
A stolen GitHub login turned npm's trusted-publishing pipeline into a self-deleting RAT delivery chain. https://intel.threadlinqs.com/threat/TL-2026-2605 #ThreatIntel #BeaverTail #OmniStealer #DEVPOPPER
