ChainDrop worm crawls into npm supply chain, evades standard defenses The Register 15 Aug 2026 Shai-Hulud variant poisons 444 packages, spreads via tarballs and dev-tool hooks Read the full article at The Register