DEV TOOLS Signal 447
ChainDrop worm infects 444 npm packages, spreads via tarballs and IDE hooks
↗
ChainDrop, a new variant of the Shai-Hulud npm worm, infected 444 npm packages by propagating through tarballs and IDE configuration hooks rather than source commits, evading standard repository defenses.
ChainDrop evades typical supply chain defenses by spreading through tarballs rather than source commits, meaning reviewing repository code won't reveal infection. It also places hooks in VS Code and Claude Code configuration files, so simply opening an infected branch can compromise credentials and continue the cycle.
Written by elseif from the cluster below · every claim links back to a sourceThe three things worth knowing
ChainDrop infected 444 npm packages collectively downloaded about 2 billion times per month, targeting infrastructure dependencies like keyv, flat-cache, and cache-manager.
The worm propagates via tarballs rather than source commits, so reviewing repository code won't reveal tampering.
Opening an infected Git branch in VS Code or Claude Code triggers background tasks that harvest credentials, beginning the infection cycle anew.
THE CLUSTER