A self-propagating worm called ChainDrop hit the npm registry on August 4, 2026, poisoning more than 400 packages in under four hours from a single hijacked maintainer account — and unlike the npm attacks before it, this one is built for the AI-coding era. It runs on a plain npm install, it steals your Claude, Codex, Cursor, and Gemini credentials along with every cloud and CI token in reach, and it writes itself into .claude/settings.json and .vscode/tasks.json so it runs again the next time you open the project. If you install npm packages — especially in CI — treat any token that touched a build since the 4th as exposed. The four-step cleanup is at the bottom; the reason it matters is in between.

What happened#

The worm started from keyv and cacheable — mundane caching libraries maintained by one person, with a combined ~2 billion monthly downloads across their package family (Microsoft Security; Elastic Security Labs). The attacker compromised the maintainer's GitHub account, pushed malicious code, and let npm's own publishing flow do the rest. Within four hours it had spread to 400+ packages and 2,000+ malicious versions, brushing dependencies used by Deliveroo, Picsart, Qlik, and ServiceTitan along the way (BleepingComputer).

ChainDrop is a descendant of the Shai-Hulud worm family, and it spreads on its own: after stealing credentials on one machine, it authenticates to npm as the victim, enumerates every package that identity can publish, and republishes each one with the same malicious hook — bumping the patch version so it slides into the next npm install (Unit 42). The attacker doesn't have to lift a finger after patient zero.

Why this one is a founder problem, not just a security-team problem#

Three properties make ChainDrop different from the poisoned-package incidents we've covered before — like the Mastra framework attack or the infostealer that first went after Cursor and Claude config in July.

It fires on install, not on import. The payload is a package.json preinstall lifecycle hook that launches a dropper (setup.mjs, which pulls the Bun runtime and runs an obfuscated mathinit.js). npm executes that hook automatically during npm install — in your terminal, in CI, in a Docker build (StepSecurity). You never had to require() the package. A solo founder running npm ci in a GitHub Action is exactly the target.

It hunts your AI-coding-agent keys. Past supply-chain malware grabbed npm tokens and cloud keys. ChainDrop adds Anthropic/Claude, OpenAI/Codex, Cursor, and Gemini credentials to the harvest, alongside GitHub PATs, AWS/GCP/Azure keys, Vault tokens, Kubernetes service-account tokens, and SSH keys (CSO Online). For a team of one, those AI keys often carry real spend and access to private repos.

It persists inside your editor and your agent. This is the part to sit with. Security teams found ChainDrop writing a .vscode/tasks.json task labelled Environment Setup, set to run on folder-open, and injecting session hooks into .claude/settings.json — so the payload re-executes the next time you open the project in VS Code or start a Claude Code session, even after you delete node_modules (Microsoft Security; Unit 42). "Just reinstall" no longer cleans it. Your agent's config directory is now a persistence mechanism.

For good measure, it fetches its command-and-control addresses from an Ethereum smart contract (the EtherHiding technique), so domain blocklists and takedowns lag behind it. You can't wait for a blocklist to save you.

Do these four things this week#

Every step here is something a solo builder can finish today. None of it requires a security team.

1. Stop lifecycle scripts from auto-running. Upgrade to npm 12 or newer, which blocks install lifecycle hooks by default — the single highest-value control against a preinstall worm. If you can't upgrade yet, add --ignore-scripts to your install step and allowlist only the handful of packages that genuinely need a build step. We wrote the upgrade path in npm v12 Broke Your Install: a 15-minute migration.

# CI and local: don't run package build hooks by default
npm install --ignore-scripts

# allow specific packages that truly need a native build
npm rebuild better-sqlite3 esbuild

2. Audit your AI-tool and editor config in every repo. Grep for injected hooks and tasks you didn't add — this is where the persistence lives, so a clean node_modules is not enough.

# from a repo root — look for what shouldn't be there
grep -R "preinstall" package.json
ls -la .vscode/tasks.json .claude/settings.json .cursor/ 2>/dev/null
# a task set to run on folder-open, or a hook you didn't write, is the tell
cat .vscode/tasks.json 2>/dev/null

If you find an Environment Setup task, an unexpected setup.mjs/mathinit.js, a surprise Bun download, or hooks in .claude/settings.json you didn't author — assume compromise and go to step 3 immediately.

3. Rotate every credential that touched a build since August 4. npm tokens, GitHub PATs, AWS/GCP/Azure keys, Vault and Kubernetes tokens, SSH keys — and your Anthropic, OpenAI, Cursor, and Gemini API keys. Rotation is the only remedy for a stolen secret; masking or deleting the malware doesn't un-steal it. Going forward, hand agents short-lived, scoped credentials instead of long-lived keys so a future leak expires on its own.

4. Pin dependencies and turn on registry scanning. Commit your lockfile, pin exact versions so a poisoned patch can't slip in on the next build, and enable your registry's malware scanning and the supply-chain gates GitHub now ships. If you let a coding agent auto-install packages, read our note on slopsquatting and agent auto-install — the same install-time discipline applies.

What it signals#

ChainDrop is the moment supply-chain attackers stopped treating AI coding tools as a side target and started treating them as the target — both for the credentials they hold and for the config directories that give an attacker persistence a package can't. The defensive features the platforms shipped this summer, like Claude Code's sandbox credential masking, guard exactly this surface, and they're worth turning on. But the durable lesson is older than any of it: an npm install executes code, that code runs as you, and "reinstall to fix it" is no longer true. Block the scripts, scope the keys, and check the two config files the worm taught everyone to weaponize.