Threat · curated 15 Aug 2026
ChainDrop worm crawls into npm supply chain, evades standard defenses
First reported theregister.com
Coverage timeline
Single-source incident — first reported, latest, and curated coincide.
Why it matters
ChainDrop weaponizes AI coding agents such as Claude Code as a silent infection trigger, meaning developers using agentic dev tools can be compromised by merely opening a poisoned repository, bypassing standard source-review and install-time defenses.
ChainDrop, a new variant of the Shai-Hulud npm worm dubbed by Microsoft and others, has poisoned 444 packages (collectively downloaded ~2 billion times a month, including keyv, flat-cache and cache-manager) and self-replicates by rebuilding package tarballs to embed its payload rather than committing to source repos. It harvests npm tokens, cloud keys and secrets from shell configs, environment variables and live memory, and plants startup hooks in repo config files so that simply opening an infected Git branch in VS Code or Claude Code triggers execution without any npm install.
Summary
ChainDrop is a new variant of the Shai-Hulud npm worm that, as of an August 4, 2026 discovery, had poisoned 444 packages from multiple publishers collectively downloaded about 2 billion times a month, including deep infrastructure dependencies such as keyv, flat-cache, and cache-manager.[0]
Unlike typical supply chain attacks, ChainDrop propagates through rebuilt package tarballs and by injecting startup hooks into repository configuration files (.claude/settings.json and .vscode/tasks.json), so merely opening an infected Git branch in VS Code or Claude Code can trigger credential harvesting without any visible malicious source commit.[0]
The worm harvests npm tokens, cloud keys, GitHub credentials, and other secrets from workspaces, environment variables, and memory, exfiltrates them to attacker-controlled endpoints, and self-replicates by rebuilding tarballs of packages a stolen token can access and by committing malicious configuration into accessible GitHub branches.[0]
Attack chain
- Trigger / execution: Execution begins either through installing an infected package or, notably, by opening an infected Git branch in VS Code or Claude Code, which runs startup hooks placed in repository configuration files.[0]
- Credential and secret harvesting: Once triggered, ChainDrop scours the user's workspace for npm tokens with full write privileges plus other credentials such as cloud keys and secrets, searching shell configurations, environment variables, and live memory.[0]
- Exfiltration: Any stolen data is encrypted and sent back to attacker-controlled endpoints.[0]
- npm self-replication via tarballs: If it finds an npm token, ChainDrop downloads the tarballs of all packages that token can fully access, rebuilds each tarball to embed its own payload, and republishes—bypassing the repository so source review reveals no tampering.[0]
- GitHub branch poisoning: ChainDrop also searches for GitHub credentials, queries the GitHub API to list accessible repositories and branches, and commits malicious configuration code directly into those branches, seeding infection for the next developer who opens the repo.[0]
- CI/CD amplification: Because npm is integrated into automated CI/CD pipelines that pull patch updates for dependencies during rebuilds, the worm gains a path into fresh builds.[0]
Disclosure timeline
| Date | Event |
|---|---|
| September 2025 | The original Shai-Hulud self-replicating npm worm first appeared and was named by security researchers after Frank Herbert's Dune sandworms.[0] |
| August 4, 2026 | Multiple security researchers identified the large-scale ChainDrop npm supply chain attack infecting 444 packages; Microsoft published its analysis dubbing the variant 'ChainDrop'.[0][1] |
| August 15, 2026 | The Register published its report on ChainDrop; infected packages had been yanked from npm and SafeDep had published a compromised-package list.[0] |
How it works
ChainDrop abuses an execution path that dependency scanning tools were not configured to inspect: repository-supplied configuration files. It places startup hooks into .claude/settings.json and .vscode/tasks.json, so that opening the repository in Claude Code or VS Code silently runs a background task that begins credential harvesting.[0]
Propagation avoids repository source commits. Instead of committing malicious code to package source, ChainDrop rebuilds package tarballs to include its payload and republishes them using stolen npm tokens with full write access, meaning code review of the source repository will not reveal the tampering.[0]
Affected versions and patch status
| Product | Affected | Patch status |
|---|---|---|
| npm packages (keyv, flat-cache, cache-manager and 441 others) | 444 packages from multiple publishers, collectively downloaded about 2 billion times a month, were infected with the ChainDrop payload. | All infected packages were quickly yanked from npm; SafeDep published a list of compromised packages with version numbers for defenders to check against running versions.[0] |
Indicators of Compromise
| Type | Indicator | Context |
|---|---|---|
| file-path | .claude/settings.json | ActiveState advises checking for a .claude/settings.json file you did not add yourself, across all branches, as ChainDrop plants startup hooks in this configuration file.[0] |
| file-path | .vscode/tasks.json | ChainDrop places startup hooks into VS Code task configuration; defenders should check for a .vscode/tasks.json file they did not add themselves, on all branches, not just main.[0] |
Key takeaways
- ChainDrop demonstrates that supply chain worms can propagate without any malicious source commit—by rebuilding tarballs and injecting execution hooks into IDE and AI-assistant configuration files—defeating source-review and standard dependency scanning.[0]
- Repository-supplied configuration for tools like VS Code and Claude Code must now be treated as executable content; ActiveState warns this is the first campaign to exploit that gap at scale and will not be the last.[0][2]
Defensive actions
- Check all repository branches for .claude/settings.json and .vscode/tasks.json files you did not add yourself.: ChainDrop hides its startup hooks in these configuration files and poisons non-main branches, so scanning only the main branch or the package source will miss the infection.[0]
- Cross-check running package versions against SafeDep's published list of compromised packages.: 444 packages including keyv, flat-cache, and cache-manager were poisoned with specific compromised versions; SafeDep provides the affected version numbers.[0]
- Treat repository-supplied configuration as executable content and evaluate trusted publishing tools such as GitHub Actions.: ChainDrop found an execution path in the dev tools organizations rapidly adopted, and dependency scanning was not configured to inspect it.[0]
- Rotate and tightly scope npm tokens and GitHub credentials, and review CI/CD pipelines that auto-pull dependency patch updates.: The worm harvests full-write npm tokens and GitHub credentials to self-replicate, and CI/CD pipelines that automatically pull patch updates give it a path into fresh builds.[0]