ChainDrop is an npm worm (a Shai-Hulud variant) that hijacked publishing access to 444 packages with roughly 2 billion monthly downloads. It abuses malicious hooks planted in Claude Code (SessionStart) and VS Code (folderOpen) to trigger execution the moment a developer opens an infected branch or starts a coding session. Once triggered, it searches for npm, GitHub, cloud, Kubernetes, and Vault credentials, then automatically republishes poisoned package versions — all at machine speed with no human pause in the loop. The post argues that AI agents have collapsed the gap between credential discovery and abuse to near-zero, fundamentally breaking the human-reaction-time window defenders relied on. GitGuardian promotes its Credential Layer Security Platform, Developer Endpoint Protection, and AI hooks as controls that detect exposed secrets across the SDLC, prioritize remediation by validity, and prevent agents from reading or transmitting credentials.
Table of contents
TL;DRChainDrop shows what machine-speed credential abuse looks likeAI agents have changed the credential abuse timelineWhy credential security must start before runtimeHow GitGuardian helps stop machine-speed credential abuseDeveloper Endpoint Protection secures credentials around AI agentsCredential security has to operate at machine speedQuestions this post answers
How did the ChainDrop npm worm use Claude Code to spread?
ChainDrop planted a malicious SessionStart hook inside Claude Code projects. When a developer began an AI coding session, the hook launched a dropper automatically. A similar folderOpen task was placed in VS Code projects, triggering on repository open. Stolen GitHub credentials then let the worm push these malicious configurations into branches, so any developer opening a poisoned branch could trigger execution without any unusual action on their part. Developers relying on AI coding tools track supply chain threats like this on daily.dev.
How many npm packages and downloads were affected by ChainDrop?
ChainDrop compromised 444 npm packages from multiple publishers, collectively downloaded approximately 2 billion times per month, according to Microsoft. Affected dependencies included keyv, flat-cache, and cache-manager. The worm found usable npm publishing credentials, enumerated every package accessible to that identity, modified the tarballs, incremented versions, and republished them with a malicious payload. Teams shipping npm packages can follow supply chain security developments on daily.dev.
7.1K Impressions2 Comments