CHAINDROP npm worm planted persistence hooks in Claude Code settings
What happened
A self-propagating worm starting from a hijacked maintainer account spread to 452 npm packages with around two billion monthly downloads. Alongside cloud and CI secrets it harvested AI tool configs and planted hooks in Claude Code and VS Code settings so it re-ran on every coding agent session.
The attack began when the GitHub account of the developer behind keyv and cacheable, widely used caching libraries for JavaScript, was taken over. The attacker published a poisoned keyv release on 4 August and planted a worm that runs when a package is installed, then uses any npm and GitHub tokens it finds to publish poisoned versions of every other package the victim can publish. It spread to more than 2,200 versions of about 450 packages within hours, with around two billion monthly downloads between them, and affected organizations including Deliveroo, Picsart, Qlik and ServiceTitan.
The payload steals cloud credentials, build pipeline secrets, developer tokens, AI tool configuration files and cryptocurrency wallets. It also adds a start-up hook to Claude Code's settings and a similar one to VS Code, so the malware runs again every time a developer opens a coding-agent session, and its own commits were signed with the author name claude to blend in. Security researchers tie it to the Shai-Hulud family of npm worms.
How it happened
Manipulated AI: Agent hijack. Malware or poisoned configuration took control of AI tools already installed on the victim's machine and turned them against the victim.
Models from several AI vendors were involved. The product was Claude Code, a type of coding assistant.
Impact
Data was exposed. Data involved: credentials. The impact spread across a wide ecosystem of developers, users and organizations.
Severity is rated High, calculated from how far the incident reached and how sensitive the data was.
Was the AI at fault?
No. The failure was in the systems, settings or people around the AI, not in the model's behaviour.
Status and timeline
Confirmed by the affected organization, the AI vendor, a regulator or a named security research firm.
It became public on 4 Aug 2026.