npm Worm Outbreak: 'ChainDrop' Hits 440+ Packages in Hours as a Keyv-Linked Chain Plants Claude Code Hooks
The npm ecosystem's worst day of the summer. A self-propagating worm Microsoft calls ChainDrop hit 440-plus packages in under four hours, and a Keyv-linked chain poisoned as many as 868 — planting Claude Code and VS Code hooks in compromised environments.
The npm registry just had its worst single day of the summer. In under four hours on August 4, a self-propagating worm poisoned more than 440 packages, and by the time trackers caught up, one tally of the wreckage ran as high as 868. Microsoft's threat researchers gave the campaign a name — ChainDrop — and flagged the part that should worry anyone shipping code with AI tools: this malware doesn't stop at stealing credentials. It plants auto-run hooks for Claude Code and VS Code inside the environments it lands in.
Two threads of reporting collided on the same 24 hours. Microsoft and CyberScoop described a credential-stealing worm — a variant of the self-replicating "Mini Shai-Hulud" malware linked to a crew tracked as TeamPCP — tearing through 400-plus npm packages by republishing malicious updates. Separately, The Hacker News traced a worm that first surfaced in keyv@6.0.0, spread out of the Keyv and Cacheable namespaces, and did something new on its way out. Whether those are two names for one campaign or two closely related events is still open — but the overlap is hard to miss.
What Microsoft and CyberScoop Reported
Microsoft's writeup is blunt about the shape of the thing: ChainDrop is a credential-stealing worm sitting inside 400-plus compromised npm packages, and it spreads by republishing malicious updates to packages it can reach. That "republishing" detail is the whole story. This isn't a single poisoned dependency that a maintainer can yank. It's a mechanism that turns each compromised package into a launch point for the next one.
CyberScoop tied the payload to the Mini Shai-Hulud family — a self-replicating strain that security teams have been chasing across open-source ecosystems — and to TeamPCP, the group associated with earlier waves. The number that stands out is the pace: 440 packages compromised in under four hours. Supply-chain incidents usually unfold over days as researchers piece together a dependency graph. This one moved at machine speed because the spreading was automated.
How the Worm Spreads
You don't need the payload internals to understand the defender-relevant mechanics, and I'm not going to reprint them. At a high level: the malware runs when a poisoned package is installed, hunts the local machine and any CI runners for tokens and secrets, and then uses whatever publishing rights it recovers to push tampered versions of other packages the victim can access. Each of those becomes a new carrier. Bump the version, republish, repeat.
That design is why the counts exploded so fast, and why a single compromised maintainer account can cascade into hundreds of package names. It also explains why CI/CD systems are squarely in the blast radius — build pipelines pull fresh dependencies constantly, run install scripts without a human watching, and hold exactly the kind of long-lived credentials the worm is looking for.
The Keyv-Linked Chain — and the Counting Problem
The Hacker News account starts the timeline at keyv@6.0.0. From the Keyv and Cacheable namespaces, the worm spread into hundreds of packages over the course of August 4. The tallies depend on who's counting and when: SafeDep verified 353 poisoned versions across 79 package names in its first pass, wider monitoring put it at 442 versions across 353 names, and Aikido reported at least 868 packages. Those aren't contradictions so much as snapshots of a moving target — the number kept climbing as the worm republished and more trackers widened their nets.
Is the Keyv chain the same thing as ChainDrop? Public reporting increasingly reads like one event — the Keyv-first origin and Microsoft's "440 in under four hours" line up neatly, and both point at the Mini Shai-Hulud lineage. But I haven't seen a vendor formally state the two labels describe a single, identical campaign, so treat "same campaign" as the likely-but-unconfirmed read rather than settled fact. Either way, the defensive response is the same.
The Standout: Claude Code and VS Code Hooks
Here's the detail that makes this outbreak different from the npm compromises that came before it. According to The Hacker News, the Keyv-linked worm plants hooks tied to Claude Code and VS Code in the environments it infects. In plain terms, it's trying to wire itself into the developer's AI coding assistant and editor so it can run again later — a persistence play aimed squarely at the modern, AI-assisted dev workflow.
Exactly what those hooks do once triggered isn't fully pinned down in the public reporting, and I'd flag it as still being characterized. I also haven't seen a formal advisory from Anthropic or a confirmed CVE attached to this behavior as of publication. What's clear is the intent: the attacker treats your AI dev tooling as attack surface. That's the shift worth internalizing, whatever the mechanics turn out to be.
What Node.js and AI-Dev-Tool Users Should Verify Now
If you or your CI systems installed npm packages in the last week, work through this today rather than waiting for a full package list to settle:
- Audit
package-lock.jsonfor dependencies that updated recently, especially anything in or downstream of the Keyv and Cacheable namespaces. - Pin versions to known-good releases and hold off on unplanned upgrades until the dust settles.
- Scan the registry for the packages you actually depend on, and check whether any pulled a version published during the August 4 window.
- Rotate CI and npm credentials that were present or used in the past week — tokens, publish keys, and any cloud or Vault secrets those runners could see.
- Inspect
~/.vscode/and your Claude Code configuration for hooks, tasks, or session-start entries you didn't create.
The credential rotation matters most. A stolen npm publish token is what lets this worm keep spreading, so revoking anything that touched a build in the affected window shrinks the blast radius even if you can't yet confirm you were hit.
The 2026 npm Supply-Chain Picture
This isn't landing in a quiet year. The open-source supply chain has been a running theme — Unit 42's NOVA system spent the summer disclosing more than 14,000 AI-discovered zero-days across open-source projects, a reminder of how much unreviewed code sits under everyone's dependency tree. And the attacker interest in AI developer tooling that shows up here echoes what we saw when Google pulled three Agent Development Kit workflows after Pillar Security demonstrated an agent-to-agent attack. The pattern is consistent: as more of the build process gets automated and AI-assisted, attackers follow the automation.
ChainDrop is the natural escalation of that trend. A self-spreading worm removes the human bottleneck from the attacker's side entirely, and the AI-tool hooks show they're already thinking about where developers will be working next.
My read: The scary number here isn't 868 packages — counts like that get revised, re-scoped, and mostly cleaned up. The scary number is "under four hours." Self-propagation means the ecosystem's response time has to compress from days to minutes, and most teams' dependency review simply doesn't run that fast. Combine that with hooks aimed at Claude Code and VS Code, and the lesson is that your AI dev environment now needs the same skepticism you'd give any other execution surface. Trusting a workspace, or letting a project drop config into your editor, is a security decision — treat it like one.
Open Questions
- The full list of affected packages, and whether npm has taken all malicious versions down.
- Whether the Keyv-linked chain and Microsoft's ChainDrop are formally the same campaign — the reporting leans yes, but it isn't confirmed.
- The initial-compromise vector that started the whole cascade.
- Exactly what the Claude Code and VS Code hooks execute once triggered.
- Whether Anthropic or Microsoft will issue formal advisories, and whether any CVE IDs get assigned.
