--- title: "ChainDrop npm Worm: AI Agents And Credential Abuse" url: https://daily.dev/posts/chaindrop-npm-worm-ai-agents-and-credential-abuse-yepzd5f8l source_url: https://blog.gitguardian.com/chaindrop-npm-worm-credential-abuse type: article source: "GitGuardian" published: 2026-08-20T14:03:24.289Z updated: 2026-08-21T23:13:18.941Z tags: ["security", "ai-agents", "npm", "gitguardian"] reading_time: 11 upvotes: 6 comments: 2 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ChainDrop npm Worm: AI Agents And Credential Abuse **[GitGuardian](https://daily.dev/sources/gitguardian)** · 11 min read · 6 upvotes · 2 comments ## Summary ChainDrop is an npm worm (a Shai-Hulud variant) that hijacked publishing access to 444 packages with roughly 2 billion monthly downloads. It abuses malicious hooks planted in Claude Code (SessionStart) and VS Code (folderOpen) to trigger execution the moment a developer opens an infected branch or starts a coding session. Once triggered, it searches for npm, GitHub, cloud, Kubernetes, and Vault credentials, then automatically republishes poisoned package versions — all at machine speed with no human pause in the loop. The post argues that AI agents have collapsed the gap between credential discovery and abuse to near-zero, fundamentally breaking the human-reaction-time window defenders relied on. GitGuardian promotes its Credential Layer Security Platform, Developer Endpoint Protection, and AI hooks as controls that detect exposed secrets across the SDLC, prioritize remediation by validity, and prevent agents from reading or transmitting credentials. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did the ChainDrop npm worm use Claude Code to spread? ChainDrop planted a malicious SessionStart hook inside Claude Code projects. When a developer began an AI coding session, the hook launched a dropper automatically. A similar folderOpen task was placed in VS Code projects, triggering on repository open. Stolen GitHub credentials then let the worm push these malicious configurations into branches, so any developer opening a poisoned branch could trigger execution without any unusual action on their part. _Developers relying on AI coding tools track supply chain threats like this on daily.dev._ ### How many npm packages and downloads were affected by ChainDrop? ChainDrop compromised 444 npm packages from multiple publishers, collectively downloaded approximately 2 billion times per month, according to Microsoft. Affected dependencies included keyv, flat-cache, and cache-manager. The worm found usable npm publishing credentials, enumerated every package accessible to that identity, modified the tarballs, incremented versions, and republished them with a malicious payload. _Teams shipping npm packages can follow supply chain security developments on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@agustinbarrientos** · 0 upvotes > I suspect the response window has effectively disappeared. When discovery and republishing happen in one automated chain, short-lived credentials and least privilege become containment boundaries, not cleanup advice. --- Tags: [#security](https://daily.dev/tags/security), [#ai-agents](https://daily.dev/tags/ai-agents), [#npm](https://daily.dev/tags/npm), [#gitguardian](https://daily.dev/tags/gitguardian) [View this post on daily.dev](https://daily.dev/posts/chaindrop-npm-worm-ai-agents-and-credential-abuse-yepzd5f8l)