Security

ChainDrop: the npm worm that reinfects via AI configs

A worm that poisoned 444 npm packages on 4 August also planted auto-run files in Claude Code and VS Code, so cleaning node_modules is not enough.

What happened: 4 August 2026 · Written: 31 August 2026
Attack 4 August 2026; StepSecurity published its analysis afterwards.

What happened on 4 August

StepSecurity says it flagged a surge of malicious npm package releases between 09:40 and 13:20 UTC on 4 August 2026. In that window, by the firm’s own count, a self-replicating worm poisoned 444 packages and 2,212 versions across more than a dozen victim organisations. StepSecurity and Cycode both name keyv@6.0.0, a package with over 150 million weekly downloads, as the starting point of the campaign.

The under-four-hours framing needs a small footnote. The 09:40 mark is when StepSecurity started recording malicious releases, not when the attack began. Cycode’s timeline puts the trojanised keyv publication at 09:35 UTC and the malicious commit landing in the keyv repository at 09:02 UTC. Measured from that commit, the operation ran longer than four hours. Measured from publication to the last poisoned release, the compressed window holds.

Anyone whose build pulled a fresh version of an affected package during that window is in scope, along with anyone who inherited one transitively. Because keyv sits deep in the dependency graph of caching and tooling libraries, the blast radius is not limited to teams that install it deliberately. Lockfiles that moved on or after 4 August 2026 are the first thing to look at.

The part that is genuinely new

The payload does not stop at stealing and leaving. StepSecurity documents two repository-level files planted by the worm: a SessionStart hook in .claude/settings.json and a VS Code task in .vscode/tasks.json set to run on folderOpen. Each one executes a copy of the dropper. Opening the repository in Claude Code or VS Code re-runs the malware, on a machine that may already have been cleaned once.

The credential list spans vendors rather than one product: .claude/credentials.json, .claude.json, .codex/auth.json, .cursor/credentials.json, .openai/auth.json, .anthropic/auth.json and .gemini/.env. If your team has standardised on any mainstream AI coding assistant, its stored tokens were in scope. Those tokens are not merely billing exposure. They authorise a tool that reads and writes source code, which puts them closer to a deploy key than to an API quota.

The novelty claim deserves precision. ZeroHunt describes ChainDrop as the first worm it has seen that treats the AI coding assistant as both a credential store and a reinfection vector. That is narrower than first to steal AI-agent credentials, which is not accurate: the SANDWORM_MODE campaign disclosed on 20 February 2026 already targeted AI developer tooling and harvested LLM API tokens through fake MCP servers. The persistence, not the theft, is the new element.

Where the reporting disagrees

Treat the counts as vendor telemetry rather than consensus. The 2,212 versions figure is StepSecurity’s own. CyberSecurityNews described more than 1,300 malicious releases, and Cycode put it at over 2,000 versions across affected scopes. The 444-package figure is the one that holds across StepSecurity and independent coverage, which is why it is the number worth quoting. Microsoft designated the campaign ChainDrop while other researchers tracked the same activity as Mini Shai-Hulud.

The entry point is also less settled than the headlines suggest. Naming keyv as patient zero is the conclusion of StepSecurity and Cycode. CyberSecurityNews states that the initial entry point has not been disclosed. That gap matters if you are writing an incident report: how the maintainer account or repository was reached is still open, so any control you add assuming a stolen npm token may be aimed at the wrong door.

What to actually do

Start with the two files, because they are the ones that survive a reinstall. Search every repository your team cloned or updated since 4 August 2026 for .claude/settings.json and .vscode/tasks.json, and read them rather than trusting their mere presence. A SessionStart hook, or a task set to run on folderOpen, that nobody on the team added is the finding. Do not open a suspect repository in an AI-enabled editor while you investigate.

Then rotate, in this order: the AI assistant tokens listed above, any npm publish tokens sitting on developer machines, and cloud credentials stored in the same home directory. Rotation is only worth doing after the hook files are gone, otherwise the next folderOpen hands over the new tokens as well. Check the publish history on your own packages for versions nobody remembers cutting.

Longer term, the assumption to drop is that an editor configuration file is inert. It is executable content that runs on open, and it arrives through the same pull requests and dependency updates you already accept without reading. Add both paths to code review attention, pin dependencies instead of tracking ranges, and give AI assistant credentials a short lifetime rather than a permanent one on every laptop.

Questions readers ask

Where every figure came from

Each claim above was checked against a primary source, then checked again by a second reader who had not seen the first check. Open any of them and verify us.

1. StepSecurity’s own blog states the ChainDrop worm poisoned 444 packages and 2,212 versions in under four hours across more than a dozen victim organizations. stepsecurity.io 2026-08
2. StepSecurity places the surge of malicious npm releases between 09:40 and 13:20 UTC on 4 August 2026, matching the story’s stated window. stepsecurity.io 2026-08-04
3. StepSecurity names keyv@6.0.0 (over 150M weekly downloads) as the starting point of the campaign, i.e. patient zero. stepsecurity.io 2026-08-04
4. StepSecurity documents the two repository-level persistence files the worm plants: a Claude Code SessionStart hook and a VS Code folderOpen task, each running a copy of the dropper. stepsecurity.io 2026-08
5. The payload targets AI coding-agent credential files across several vendors, confirming the AI-credential-theft element of the story. stepsecurity.io 2026-08
6. Independent coverage confirms the 444-package figure and the two auto-run configuration files, and notes Microsoft designated the campaign “ChainDrop” while other researchers tracked it as “Mini Shai-Hulud”. cybersecuritynews.com 2026-08
7. The “first” framing in the wild is narrower than the story’s: ChainDrop is described as the first worm to treat the AI assistant as BOTH a credential store AND a reinfection vector — not the first to steal AI-agent credentials. zerohunt.ai 2026-08
8. AI coding-agent credential theft by npm worm campaigns predates August 2026: the SANDWORM_MODE campaign disclosed 20 February 2026 already targeted AI developer tooling and LLM API tokens. labs.cloudsecurityalliance.org 2026-02-20
9. That earlier February 2026 campaign explicitly harvested LLM API tokens from AI coding assistants, which is the same class of credential the story claims ChainDrop was first to target. labs.cloudsecurityalliance.org 2026-02
10. Cycode’s timeline puts the trojanized keyv publication at 09:35 UTC, with the malicious commit pushed to the keyv repository at 09:02 UTC — i.e. the attack itself began before the 09:40 window. cycode.com 2026-08-04

More on AI agents

• Security CVE-2026-35603: only one of four vendors has patched Four AI coding assistants trusted a Windows folder any user can write to, and of the four vendors told about it, only Anthropic has shipped a fix.
• Pricing GitHub Copilot moved to usage-based billing on 1 June Base prices did not move, but the meter did. The promotional credits that cushioned existing Business and Enterprise customers ran out at the end of August.
• Pricing Cursor Teams gains two usage pools and a $96 seat The June restructure separates first-party from third-party spend and adds a $96 seat. The interesting detail is what Cursor has not published about included usage.