A major new malware campaign has compromised hundreds of popular software packages on the npm registry, posing a severe supply chain threat to developers and organizations worldwide. Security researchers have identified the campaign, dubbed ChainDrop, as a variant of the self-propagating ShaiHulud infostealer worm.