More than 400 NPM packages have been infected with the Mini Shai-Hulud worm in the ChainDrop supply chain attack.