ChainDrop npm worm - Bun-loaded preinstall dropper (setup.mjs / math_init.js)

Ankit Mehta@Secvyn

•updated Aug 6, 2026•5•0•7

Detects execution of potentially malicious JavaScript files (e.g., setup.mjs, math_init.js) via Node.js or Bun command-line tools. This often indicates the execution of obfuscated or unauthorized scripts during software installation or supply chain compromise attempts.