Summary
On August 4, 2026 a self-propagating npm worm dubbed ChainDrop compromised 444 packages and 2,212 versions in under four hours, beginning with keyv@6.0.0 after a maintainer account was compromised. Notably, the malware attempted to persist through Claude Code hooks and VS Code tasks, a novel repository-open attack vector aimed at AI developer toolchains.
What changed
A self-propagating supply-chain worm, ChainDrop, spread across the npm registry on August 4, 2026, poisoning 444 distinct packages and 2,212 versions in under four hours starting from keyv@6.0.0. Beyond stealing credentials, it sought persistence through Claude Code hooks and VS Code tasks, so simply opening an affected repository in an AI-assisted editor could trigger execution.
Why it matters
The attack weaponizes exactly the automation that makes AI coding tools powerful: agent hooks and editor tasks that run on repository open. It shows that the AI developer toolchain is now an explicit supply-chain target and raises the stakes on install-time and repo-open code execution, reinforcing defenses like npm v12 disabling install scripts by default and JSR shipping Sigstore provenance with no install scripts.
Evidence excerpt
ChainDrop, a self-propagating npm worm, poisoned 444 packages and 2,212 versions in under four hours, starting with keyv@6.0.0; it attempts to persist through Claude Code hooks and VS Code tasks.