A new variant of the Shai-Hulud npm worm has compromised 444 packages from multiple publishers that are collectively downloaded roughly 2 billion times monthly, according to a security report published August 15 by The Register. Security researchers first identified the large-scale npm supply chain attack on August 4, spotting a Shai-Hulud variant dubbed "ChainDrop" by Microsoft and others. The assault targeted heavily used deep infrastructure dependencies, including keyv, flat-cache and cache-manager.
ChainDrop uses propagation methods that can leave virtually no evidence in the corresponding source repositories, a departure from typical open source breaches. The malware spreads through tarballs—an archive format for downloading file packages—rather than through repository source commits. When executed, the software hunts through the user's workspace for npm tokens with full write privileges, as well as other credentials like cloud keys and secrets, searching in shell configurations, environment variables and even live memory. Any stolen data gets encrypted and sent back to attacker-controlled endpoints. If it locates an npm token, it downloads the tarballs of all packages that token can access, bypassing the repositories themselves, then rebuilds the tarball to include its own payload.
ChainDrop also inserts startup hooks into repository configuration files themselves, meaning simply opening an infected Git branch in VS Code or Claude Code can place your repository under the worm's control, even if you never install an infected package. The attack is two-pronged: it searches for GitHub credentials, and if it finds any, it queries the GitHub API to list all accessible repositories and branches, then commits its malicious configuration code directly into those branches. When other developers open these repositories using Claude or VS Code, a background task gets triggered that harvests credentials, beginning the cycle again. Abby Kearns, CEO of ActiveState, noted in a Medium post that "what is unique about this particular attack is that it doesn't use the typical methods of breaching the defenses of open source repositories."
The attack proves especially damaging because npm is widely integrated into automated CI/CD pipelines, which can automatically pull patch updates for dependencies during a rebuild, giving the worm a route into fresh builds. Kearns advised that infected developers should first check for any .claude/settings.json and .vscode/tasks.json files they didn't add themselves, and not just on the main branch but across all branches. All the infected packages were quickly removed from npm, and open source security firm SafeDep offers a list of all the compromised packages along with version numbers. Beyond cleanup, developers and security teams should rethink how their systems could be breached in light of ChainDrop, starting with evaluating trusted publishing tools such as GitHub Actions. Kearns wrote that teams should begin "treating repository-supplied configuration as executable content, because that is what it is now." She added that "this is the first campaign to notice the gap and use it at scale. It will not be the last one." Organizations that rushed to adopt modern development tools may now face a reckoning over the blind spots those same platforms introduce, and the race between automation and oversight will likely sharpen across every layer of the software supply chain.