"ChainDrop" npm Worm Poisons 400+ Packages and Plants Claude Code and VS Code Auto-Run Hooks

The npm accounts and repositories of the keyv maintainer and a dozen further organizations, including packages associated with Deliveroo, Ornikar, OneReach, Picsart, Qlik, and ServiceTitan

A self-propagating worm tracked as ChainDrop compromised the GitHub account of the maintainer behind keyv and, in under four hours on August 4, 2026, published poisoned versions across the maintainer's package family and beyond. Counts differ by vendor: SafeDep verified 353 poisoned versions across 79 package names, Unit 42 counted 444 packages and 2,212 versions, and Aikido reported at least 868 packages across 1,381 versions, with later tallies reaching 1,684 versions across 420 names tied to nine organizations. Affected packages included keyv@6.0.0, flat-cache@6.1.24, and file-entry-cache@11.1.6, together drawing hundreds of millions of weekly downloads. A `preinstall` script ran `setup.mjs`, fetched Bun 1.3.13 from official GitHub releases if absent, and handed control to a compiled bundle that harvested GitHub, npm, cloud, Vault, Kubernetes, and database credentials plus private keys, read GitHub Actions runner memory, installed a token-revocation watcher, and carried npm publishing machinery to poison further packages using stolen identities. The worm moved between organizations every two to seven minutes. The distinguishing feature was AI-assistant persistence: the attacker committed a `.claude/settings.json` with a SessionStart hook and a `.vscode/tasks.json` with a `runOn: folderOpen` task into the source repository, each invoking the other directory's `setup.mjs`, so simply opening a checkout in VS Code or starting a Claude Code session could run the payload with no `npm install` at all. Both files were still on the main branch at the reporting cutoff. Workspace trust in VS Code and Claude Code limited the immediate blast radius. The poisoned keyv release carried valid OIDC and SLSA provenance through GitHub Actions, and the hook-planting commit bore a GitHub-verified badge naming `github-actions[bot]`, which attested to the build process and not to the safety of the source. SafeDep advised removing the credential-revocation watcher before rotating tokens, since revocation itself could trigger attacker-supplied local handlers. Researchers place ChainDrop in the Shai-Hulud lineage, sharing the Claude Code and VS Code hooks, the `setup.mjs` filename, and the Bun 1.3.13 download with an April 2026 PyPI compromise of the `lightning` package. The operator and the initial access vector remain unidentified

One compromised maintainer account plus install-time script execution, extended by a persistence mechanism that no package scanner inspects. Editor and agent configuration files committed to a repository are executable content on checkout, so the developer's own tooling becomes the second, quieter installation path