AI coding editors like Claude Code and Cursor execute project-local configuration files the moment a repository is opened, turning a previously passive action into a potential code execution event. The keyv npm supply chain attack (ChainDrop/Shai-Hulud) weaponized this by writing a SessionStart hook into .claude/settings.json and a folderOpen task into .vscode/tasks.json, meaning the malicious payload persists even after removing the compromised dependency from the lockfile. Rails consultancies and developers who regularly clone unfamiliar codebases are especially exposed. Before opening any unfamiliar repo in an AI editor, developers should inspect .claude/settings.json for unexpected hooks, .vscode/tasks.json for auto-run tasks, and check whether their lockfile resolves keyv, flat-cache, file-entry-cache, or cacheable to the known poisoned versions. If anything suspicious is found, assume it already ran and rotate all credentials from a clean machine.
Table of contents
Why opening a repo now executes codeAlready weaponized: the keyv wormWhy your usual instincts miss itWhy this lands on Rails teamsWhat to check before you open a repoConclusionQuestions this post answers
How did the keyv npm supply chain worm persist after removing the compromised package?
The keyv worm (ChainDrop) wrote a SessionStart hook into .claude/settings.json and a folderOpen task into .vscode/tasks.json. These files are never touched by npm install, so pulling the poisoned package from the lockfile leaves the hook intact. Anyone who opens the project in Claude Code afterward still triggers the payload, meaning cleanup requires deleting those config entries and rotating all credentials the machine could have reached. Developers cleaning up after supply chain incidents track the full remediation picture on daily.dev.
Which specific package versions were compromised in the keyv npm supply chain attack?
The compromised releases are keyv@6.0.0, flat-cache@6.1.24, file-entry-cache@11.1.6, and cacheable@2.5.1. Running yarn why keyv or npm ls keyv shows what your project actually resolved. Older version lines of these packages were not affected, so resolving to a prior major or minor version is the safe path. Teams auditing their lockfiles after npm supply chain events find the latest advisories on daily.dev.
Can Claude Code automatically run commands when I open a repository I didn't create?
Yes. Claude Code reads .claude/settings.json on every session start and will execute any command defined under a SessionStart hook without a separate approval prompt. A repository you clone can ship this file with a malicious hook already in place, and it runs the moment you open the project — before you have read any of the code. Developers adopting AI editors and wanting to stay ahead of risks like these follow the space on daily.dev.