STUPID-2026-0085

Self-propagating npm worm plants persistence in Claude Code's hook files to survive credential rotation (ChainDrop / keyv supply-chain attack)

8.3high
August 4, 2026VerifiedReproducible

  1. Instruction given

    None from the affected developer — the trigger was installing (or having already installed) one of the compromised npm packages, or simply opening a repository an attacker had already written to using stolen GitHub credentials. No action targeted Claude Code specifically.

  2. Expected behavior

    A compromised package's install-time payload should be contained to that npm install. An agent's own hook and config files should not become a standing malware persistence mechanism that outlives the original compromise — rotating credentials and removing the poisoned package version should end the infection.

  3. Actual behavior

    Using credentials stolen during the initial npm compromise, the worm wrote .claude/settings.json and .claude/setup.mjs (alongside matching .vscode/tasks.json and .vscode/setup.mjs files) directly into victims' repository branches on GitHub. Because Claude Code runs hooks declared in .claude/settings.json automatically whenever it starts a session in that repository, simply opening the repo and starting Claude Code again was enough to re-launch the credential-stealing payload — independent of npm, and after the original malicious package version had already been removed.

  4. Damage

    Microsoft tracked the campaign (dubbed "ChainDrop," reported elsewhere as the keyv/cacheable or "Mini Shai-Hulud" incident) as compromising more than 400 npm packages across multiple unrelated publishers beginning around August 4, 2026, after an attacker took over a maintainer account and published trojanized releases. The preinstall payload harvested npm, GitHub, cloud, HashiCorp Vault, and Kubernetes credentials from developer and CI/CD environments. By planting itself in Claude Code's own hook configuration inside affected repositories, the worm gained a second infection route that a standard incident response — rotate credentials, pin clean package versions — would not by itself close, since the next Claude Code session in that repo could restart the payload on its own.

A supply-chain worm that compromised the keyv/cacheable npm packages in early August 2026 didn't stop at stealing credentials during `npm install` — it wrote itself into the repositories it touched so it could come back. Using GitHub credentials harvested from its initial preinstall payload, the malware (which Microsoft calls "ChainDrop" and others track as "Mini Shai-Hulud") committed `.claude/settings.json` and `.claude/setup.mjs` files into victims' repository branches, mirroring the same trick against VS Code's task-runner config. Claude Code executes hooks declared in `settings.json` automatically on startup, with no separate warning that a hook file even exists — so a developer who rotated their credentials and cleaned up the poisoned npm package could still have the malware fire again the next time they opened the same repository in Claude Code. Microsoft's analysis puts the campaign at over 400 compromised packages across unrelated publishers, with the payload reaching npm, GitHub, cloud, Vault, and Kubernetes credentials in developer and CI environments. The mechanism doesn't require a bug in Claude Code's code — it abuses a legitimate feature (automatic hook execution) that treats anything committed to a repo's `.claude/` directory as trusted, which is exactly the assumption a worm with write access to that repo can defeat.

Classification

Agent
Claude Code
Failure mode
Security Vulnerability
Root cause
Other
Domain
Security
Source
Security Research

Related incidents

10.0
Gemini CLI silently executed arbitrary code from an untrusted repo (CVE-2026-12537, CVSS 10.0)
10.0
Malicious cloned repository triggered code execution in Cursor on Windows
10.0
AI vibe-coded Next.js app pinned vulnerable dependency — cryptominer compromised production server
10.0
Claude Code wiped DataTalks.Club's production infrastructure — 2.5 years of course data — during an AWS migration
Discuss on Hacker News

Get told when an agent breaks something

We document AI agent failures daily, severity-scored against a published scale. When one lands at 7.0 or above — deleted data, leaked secrets, broken production — you get an email with the source. When nothing does, you get nothing.

This database is callable over MCP — query it from inside your agent.