Glonce

ChainDrop worm infects 444 npm packages, evades standard defenses

securityThe Glonce editorsThe Register🔥64Glonce rating64Impact65Novelty55Relevance88Surprise48Players30Credibility58
ChainDrop worm infects 444 npm packages, evades standard defenses

On August 4, 2026, multiple security researchers identified a large-scale npm supply chain attack driven by a new variant of the Shai-Hulud worm, which Microsoft and others have named ChainDrop. The Shai-Hulud malware family, named after the giant sandworms in Frank Herbert's Dune, first appeared in September 2025 as self-replicating, worm-like code. By the time researchers caught it, ChainDrop had infected 444 packages from multiple publishers, collectively downloaded about 2 billion times a month, including widely used, deep-infrastructure dependencies such as keyv, flat-cache and cache-manager.

What sets ChainDrop apart is that installing an infected package directly is one way to get hit, not the only one. ChainDrop also plants startup hooks inside a repository's own configuration files. Simply opening an infected Git branch in VS Code or Claude Code can trigger those hooks and bring the repository under ChainDrop's control, even if nobody ever ran an npm install of a poisoned package.

Once triggered, the malware scours the developer's workspace for npm tokens with full write privileges, plus other credentials such as cloud keys and secrets, checking shell configuration files, environment variables and even live memory. Anything it finds is encrypted and sent to attacker-controlled servers. If it locates an npm token, ChainDrop downloads the tarballs of every package that token can access and rebuilds each one to embed its own payload, bypassing the source repository entirely. Because the tampering lives only in the published tarball and never touches a source commit, reviewing the code repository itself turns up no evidence of the compromise. ChainDrop also hunts for GitHub credentials; when it finds them, it uses the GitHub API to list every repository and branch those credentials can reach and commits its malicious configuration directly into those branches, so the next developer who opens one of them in VS Code or Claude Code restarts the credential-harvesting cycle.

The attack is especially dangerous because npm is deeply embedded in automated CI/CD pipelines, which can pull patch-level dependency updates automatically during a rebuild, giving the worm a path into fresh builds without any direct action from a developer.

All 444 infected packages have already been pulled from npm. Open source security firm SafeDep has published a list of every compromised package with its affected version numbers, so teams can check it against what they run. Abby Kearns, CEO of enterprise open source security company ActiveState, analyzed the attack in a Medium post and advised checking every branch, not only main, for unexpected .claude/settings.json and .vscode/tasks.json files. "What this campaign really found was an execution path that dependency scanning tools were not configured to look at, sitting inside the exact tools engineering organizations have spent two years adopting as fast as they could," Kearns wrote. "This is the first campaign to notice the gap and use it at scale. It will not be the last one."

Key facts

  • ChainDrop, a new Shai-Hulud npm worm variant named by Microsoft and others, has infected 444 packages from multiple publishers that are collectively downloaded about 2 billion times a month.
  • The affected packages include widely used dependencies keyv, flat-cache and cache-manager; multiple security researchers identified the campaign on August 4, 2026.
  • ChainDrop self-replicates by rebuilding npm tarballs rather than altering source commits, so reviewing a repository's code shows no sign of tampering.
  • The worm also plants malicious startup hooks in files such as .claude/settings.json and .vscode/tasks.json; opening an infected branch in VS Code or Claude Code alone triggers credential harvesting, without any npm install.
  • All 444 infected packages have been pulled from npm, SafeDep has published a version-by-version list of them, and ActiveState CEO Abby Kearns recommends checking every branch, not just main, for unexpected hook files.

Why it matters

ChainDrop marks a jump in sophistication for the Shai-Hulud npm worm family, which first appeared in September 2025. Instead of relying only on a developer running npm install, it hides inside two places dependency scanners were not built to check: rebuilt package tarballs, which leave no trace in the source repository, and repository configuration files that fire the moment a repo opens in an editor. Abby Kearns of ActiveState argues the campaign found an execution path sitting inside the exact trusted-publishing tools that engineering organizations have spent two years adopting, and warns it will not be the last campaign to exploit that gap.

Who it affects

Anyone whose project depends, directly or transitively, on any of the 444 infected packages is exposed, among them the widely used dependencies keyv, flat-cache and cache-manager, collectively downloaded about 2 billion times a month. Developers can trigger the credential-harvesting hooks simply by opening an infected repository in VS Code or Claude Code, without ever running npm install themselves. Teams whose CI/CD pipelines automatically pull patch-level dependency updates during a rebuild are exposed too, since that mechanism can carry the worm straight into a fresh build.

How to use it

There is no product or price here, only a response checklist drawn from Kearns's advice. Check every branch, not only main, for .claude/settings.json and .vscode/tasks.json files you did not add yourself. Cross-check the packages and versions running in your project against SafeDep's published list of all 444 compromised packages. Treat repository-supplied configuration as executable content rather than inert metadata, and re-evaluate trusted-publishing tools such as GitHub Actions in light of this technique.

How solid is it

The Register's report, by Joab Jackson, is grounded in named, credentialed sources: the multiple security researchers who flagged the campaign on August 4, 2026, Microsoft and others who assigned it the ChainDrop name, and a detailed Medium post from Abby Kearns, CEO of enterprise open source security company ActiveState, that the article quotes directly. Open source security firm SafeDep independently corroborates the scope by publishing its own list of the 444 compromised packages and their affected versions, and npm has already pulled every one of them. The article does not quote a statement from npm, GitHub or Microsoft as organizations; Microsoft is credited only with naming the variant, not with any comment on the incident.

Risks and caveats

The report does not explain how ChainDrop first reaches a developer's machine before the tarball-and-hook mechanism takes over, so the initial infection vector remains unaddressed. Only three of the 444 affected packages, keyv, flat-cache and cache-manager, are named, and no downstream organizations or projects that were compromised as a result are identified. The article also does not confirm that any harvested credentials have actually been misused, only that ChainDrop harvests and exfiltrates them, and it gives no dollar figure or other quantified estimate of the damage caused.

“What this campaign really found was an execution path that dependency scanning tools were not configured to look at, sitting inside the exact tools engineering organizations have spent two years adopting as fast as they could”

— Abby Kearns, CEO of ActiveState