Executive assessment
No new findings met the reporting bar today. The 1 item(s) below are ongoing coverage of previously reported issues, still active and unresolved.
Finding 01 — Still active: ChainDrop worm crawls into npm supply chain, evades standard defenses
Coverage status: First reported 2026-08-08; ongoing coverage.
What changed: Shai-Hulud variant poisons 444 packages, spreads via tarballs and dev-tool hooks.
Why it matters: The cited reporting affects widely deployed technology, so exposure validation and source verification need explicit ownership.
Observed status: The cited source reports an active supply-chain compromise; exposure depends on use of the affected packages rather than exploitation of a single vulnerability.
Action: Review the cited source, validate exposure of the affected technology in owned environments, apply available vendor guidance, and retain evidence of the exposure decision.
Evidence limits: grounded severity unavailable
exploitation status unknown
fixed version or patch state unknown
affected product not structured
[Evidence source: www.theregister.com](<https://www.theregister.com/security/2026/08/15/chaindrop-worm-crawls-into-npm-supply-chain-evades-standard-defenses/5287958>)