ChainDrop Supply Chain Worm Compromises 444 npm Packages, Targets Claude Code and Developer Tools
Key Takeaways
- ▸Self-propagating worm compromised 444 npm packages and 2,212 versions within 4 hours, with numbers still rising
- ▸Bypassed security by compromising maintainer GitHub accounts and exploiting legitimate release workflows with valid SLSA provenance
- ▸Specifically targets AI developer tools (Claude Code, VS Code, Copilot) indicating sophisticated awareness of attack surface
Summary
A self-propagating npm worm called ChainDrop unleashed a major supply chain attack on August 4, 2026, compromising 444 packages and 2,212 versions in just four hours. The attack propagated through popular packages including keyv (150M+ weekly downloads), flat-cache (149.9M), and file-entry-cache (147.6M), touching a massive share of the JavaScript ecosystem. The worm deployed a two-stage payload: a Bun runtime dropper followed by a 710 KB obfuscated payload that harvests credentials, republishes malicious packages, and persists in developer tools.
What sets ChainDrop apart from previous supply chain attacks is its exploitation of npm's OIDC Trusted Publishing and SLSA provenance mechanisms. Rather than exploiting missing provenance, attackers compromised maintainer GitHub accounts and pushed poisoned commits through legitimate release workflows, making malware indistinguishable from legitimate, cryptographically-attested releases. The attack specifically targets Claude Code, VS Code, and GitHub Copilot workflows, indicating sophisticated knowledge of modern AI developer toolchains. Researchers identified the payload as an evolved descendant of the Shai-Hulud 2.0 worm, now featuring Ethereum blockchain-based command-and-control (C2) and analyst-proof encrypted exfiltration.
- Uses Ethereum blockchain as C2 and encrypted exfiltration to evade detection and analyst investigation
- Represents evolution of Shai-Hulud worm with automated propagation using stolen credentials and tokens
Editorial Opinion
This attack exposes a critical flaw in current supply chain security thinking: SLSA provenance and cryptographic attestation prove which code was built, but they cannot prove that code was authorized. When maintainer accounts are compromised, legitimate infrastructure becomes an adversary's distribution channel. The targeting of Claude Code and other AI developer tools reveals that attackers now understand these platforms as privileged vectors for credential theft and persistent access. Organizations must shift from relying solely on artifact verification to implementing behavioral monitoring, credential rotation policies, and defense-in-depth strategies that assume developer tools will eventually be targeted.
