Wiz pipeline flags malicious npm packages before a CVE exists
Wiz says notable supply-chain attacks rose from about 10% of significant incidents in late 2025 to 1 in 4.
48
- Mentions · 7d0
- Mentions · 30d1
- All mentions2
- First seenAug 11, 2026
- Last mentioned11d ago
Timeline
2 articles · newest firstTracking Shai-Hulud: Inside the ChainDrop NPM Worm
ChainDrop, a Mini Shai-Hulud variant tied to TeamPCP, worms through npm via a compromised maintainer account and anchors C2 in an Ethereum smart contract.
68
Appears with
- Zscaler ThreatLabzorganization · 1
- npmvendor · 1
- ChainDropmalware · 1
- plain-crypto-jsmalware · 1
- Shai-Huludmalware · 1
- Mini Shai-Huludmalware · 1
- axiosproduct · 1
- TeamPCPthreat actor · 1
- Wizvendor · 1
- flat-cacheproduct · 1
- npmproduct · 1
- cacheableproduct · 1
- GitHubvendor · 1
- Wiz Defendproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.