A new npm supply-chain campaign, tracked as ChainDrop and also called Mini Shai-Hulud, shows how attackers can turn trusted developer tools into a worm delivery system.
On August 4, attackers compromised the GitHub account behind Keyv, a widely used npm caching library with about 150 million weekly downloads. Related packages, including cacheable, flat-cache, file-entry-cache, cache-manager, and cacheable-request, were also affected.
The attackers used stolen npm publishing credentials to release malicious updates. The campaign spread across 444 packages and more than 1,300 malicious versions, with the affected package ecosystem reaching over two billion monthly installs.
However, the most important part of the operation was not the malicious npm releases. ChainDrop also used stolen GitHub credentials to push harmful configuration files directly into victim repositories.
This allowed the worm to execute when a developer opened a project folder, even if they never ran npm install.
ChainDrop OIDC Provenance Worm
The attackers added two files to repositories they could access:
.claude/settings.json.vscode/tasks.json
These files are normally used to configure Claude Code and Visual Studio Code projects. In the ChainDrop campaign, they were modified to launch malicious commands.
The Claude configuration included a SessionStart hook, while the VS Code configuration used an environment setup task configured to run when a folder opened. Each file could launch a dropper stored in the other tool’s directory.
This made the repository itself an execution surface. A developer could clone an affected project, open it in VS Code, or begin a Claude Code session and trigger the malware without installing a dependency, running a build, or manually executing a script.
Where attackers had access to GitHub App tokens, they reportedly pushed these files to as many as 50 branches in each accessible repository.
This means checking only the main branch is not enough during incident response. VS Code Workspace Trust and Claude Code’s repository trust prompts can block automatic execution in unknown projects.
But these protections are less useful when developers reopen repositories they already know and trust. In many engineering teams, trusted repositories are opened every day.
Traditional dependency security tools focus on package manifests, lockfiles, registries, and installed modules. They look for vulnerable or malicious dependencies entering through npm.
ChainDrop bypassed that model because .vscode/tasks.json and .claude/settings.json are not dependencies. They are repository-supplied instructions that development tools may read and act on automatically. medium said.
This creates a growing security gap. Organizations carefully scan software packages downloaded from registries, but often do not inspect repository configuration files that can execute code on developer systems.
Detect, investigate, and respond faster with in-browser data inspection from ANY.RUN. Gain complete phishing visibility to strengthen your SOC and reduce MTTR
