ChainDrop Worm Poisons 444 npm Packages, Slipping Past Standard Defenses

A new variant of the Shai-Hulud npm worm, dubbed ChainDrop by Microsoft and other researchers, has poisoned 444 packages that are collectively downloaded about two billion times a month, The Register reported on August 15. The campaign, first flagged by multiple researchers on August 4, hit deeply embedded infrastructure dependencies including keyv, flat-cache and cache-manager, and propagates in ways that standard repository defenses cannot see.

Propagation Without a Trace

Unlike typical supply-chain attacks, ChainDrop spreads via package tarballs rather than source commits — auditing the repository itself reveals no evidence of tampering. Once triggered, it plants startup hooks into repository configuration files: simply opening an infected Git branch in VS Code or Claude Code can hand over control, according to ActiveState CEO Abby Kearns. The worm scours workspaces for npm tokens with full write privileges, cloud keys and other credentials in shell configurations, environment variables and even live memory, encrypting and exfiltrating what it finds. It also queries the GitHub API for accessible repositories and commits malicious configuration directly into branches.

A Blind Spot in Dev Tools

Kearns warned that the campaign exploited "an execution path that dependency scanning tools were not configured to look at." She advises developers to check for unfamiliar .claude/settings.json and .vscode/tasks.json files across all branches, not just main. The infected packages have been pulled from npm, and open-source security firm SafeDep has published a full list of compromised packages and versions.