ChainDrop worm crawls into npm supply chain, evades standard defenses

A new variant of the Shai-Hulud npm worm, christened ChainDrop by Microsoft and others, has contaminated hundreds of packages in the Node ecosystem. Researchers discovered on August fourth that four hundred and forty-four packages were infected, collectively downloaded about two billion times per month. Here's what makes ChainDrop dangerous: it doesn't spread through typical source code commits. Instead, it hides inside tarballs — the compressed archives developers download. When you open an infected repository in VS Code or Claude Code, background startup tasks automatically trigger, and the malware begins harvesting your npm tokens, GitHub credentials, and cloud secrets. It then self-replicates by modifying tarballs, so reviewing source code won't reveal the attack. ActiveState's Abby Kearns notes that the worm exposes a dangerous gap: dependency scanning tools don't monitor repository configuration files as executable content — but they absolutely are. All four hundred and forty-four packages have been yanked from npm; developers should check for unexpected .claude slash settings dot json or .vscode slash tasks dot json files they didn't add, and verify their current versions against SafeDep's published list of compromised packages.

Listen to this story

Hear this and more stories in a personalized audio briefing.

Open The Chonkerton