A self-spreading worm called ChainDrop ripped through the npm registry on 4 August, and its aim was unusually modern. Alongside the usual theft of cloud and CI credentials, it went looking for the keys developers use to talk to their AI coding assistants.
The scale was set within hours. Researchers at Elastic Security Labs and Palo Alto's Unit 42 traced the outbreak to a compromised maintainer account behind several heavily used Node.js utilities: keyv, cacheable, flat-cache and file-entry-cache. From a single poisoned release, keyv@6.0.0, the worm spread to 444 packages and 2,212 versions in under four hours. Keyv alone is downloaded more than 600 million times a month, so the blast radius reached deep into the dependency trees of projects that never named it directly.
How it worked
The mechanics were old-fashioned. Attackers took over the maintainer's GitHub account, pushed malicious code to the main branch, and added a preinstall script that fired on every npm install. That script harvested npm tokens, GitHub credentials, cloud secrets and CI/CD keys and shipped them out.
What sets ChainDrop apart is where it looked next. According to a breakdown by Zero Hunt, the payload read authentication files for AI development tools by name, including .claude/credentials.json, .cursor/credentials.json and .openai/auth.json. Those files often hold organisation-level keys with broad permissions and generous rate limits, which makes them a richer prize than a single developer's password.
Persistence was cleverer still. The worm committed a poisoned .claude/settings.json with a SessionStart hook that re-ran the dropper the next time a developer opened Claude Code in that repository. It also planted a .vscode/tasks.json set to run on folder open, so the code executed the moment the project loaded in the editor, with no install step required. Both commits carried forged signatures attributed to "claude" or "github-actions[bot]", turning ordinary collaboration into an infection path.
A familiar family
Security teams place ChainDrop in the Shai-Hulud lineage, the same family behind the Mini Shai-Hulud campaign that hit TanStack, Mistral AI and OpenSearch packages in May. This wave added a modern flourish: Microsoft's Security team reported that the operators reconfigured the worm's entire command-and-control setup through a single Ethereum transaction, sidestepping the need to push a new version of the malware.
The defensive advice from StepSecurity and others is blunt. Treat any machine that ran an affected package as fully exposed. Revoke and rotate every AI-assistant key that may have touched it, scan repositories for unauthorised .claude/settings.json and .vscode/tasks.json commits, and tighten workspace-trust settings so editor config files cannot quietly execute code.
The wider lesson is uncomfortable. As AI coding tools store powerful credentials on developer machines, they become a target worth building a worm around. The keys that let a model act on your behalf are exactly the keys an attacker now wants most.
Commentarii · 0