ChainDrop Publishes Initial Malware Without Stealing a Long-Lived npm Token

The ChainDrop campaign has exposed a gap in modern software supply-chain defenses: malware no longer needs a durable npm publishing token or even an npm inst...