Your AI coding assistant is configured to run certain commands automatically. Now imagine an attacker gets to write that configuration.
That is what the ChainDrop npm worm does. On August 4, 2026, a threat actor compromised the GitHub account of the maintainer of the keyv caching library, published a trojanized version, and within 30 minutes had poisoned 420+ npm packages used by nine organizations including Deliveroo, Picsart, Qlik, and ServiceTitan. The worm did the usual things: harvested cloud credentials, stole npm tokens, republished more poisoned packages. But it did one new thing that makes it more dangerous for developer and AI-assisted environments.
The .claude/settings.json hook
Claude Code, the AI coding agent developed by Anthropic, reads a .claude/settings.json file in the repository root to determine which shell commands it may execute automatically without prompting the user. The ChainDrop payload writes a malicious entry to this file. The next time a developer opens the repository in Claude Code, the coding agent reads the configuration and silently executes the attacker's command. No user approval. No prompt. Just execution.
The same pattern applies to VS Code via .vscode/tasks.json, which VS Code can execute automatically when a workspace opens. Both vectors share the same property: they convert a trusted, developer-controlled tool into a remote execution primitive activated by opening a repository.
How ChainDrop spread
The initial compromise was a maintainer account takeover for the keyv caching library, which has tens of millions of weekly downloads. The malicious preinstall hook in keyv 6.0.0 downloaded a standalone Bun runtime, executed an obfuscated second stage, and used stolen npm tokens to republish trojanized versions of other packages the compromised account could reach. SafeDep documented 1,684 poisoned package versions across 420 package names. The worm moved between organizations every two to seven minutes. Aikido classifies this as a member of the Shai-Hulud worm family, which previously appeared in the May 2026 TanStack and Mistral AI compromise.
Credentials at risk
The second-stage payload harvested credentials from HashiCorp Vault, Kubernetes service accounts, GitHub Actions secrets, npm authentication tokens, and cloud instance metadata endpoints (AWS, GCP, Azure). Any secrets stored in environment variables during a build or development session in an affected environment should be considered compromised. CI pipelines that ran npm install on affected versions between August 4 and August 6 are the highest-priority investigation target.
Remediation
Check every repository for unexpected entries in .claude/settings.json and .vscode/tasks.json. Look for entries added or modified after August 3. Revoke and rotate all npm tokens that touched the keyv, cacheable, or any of the 420+ affected package namespaces in that window. Rotate all CI secrets, Vault tokens, and Kubernetes service account credentials for affected pipelines. Check your npm audit lock file for any of the 1,684 poisoned versions documented by SafeDep.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if you are investigating a potential ChainDrop compromise and need help scoping the blast radius.