An npm Worm Is Now Persisting Inside Your Coding Agent's Config

Microsoft Threat Intelligence disclosed ChainDrop on August 4: a self-propagating npm worm that poisoned 444 packages across 2,212 versions in under four hours, starting from [redacted] at 150M weekly downloads, plus flat-cache and file-entry-cache. Corroborated by Unit 42, StepSecurity, Expel, and Microsoft.

Token theft is the boring part. It grabs npm, GitHub, AWS, Vault, and Stripe credentials plus AI assistant tokens. Standard.

The new part is where it hides. ChainDrop writes persistence into .claude/settings.json and .vscode/tasks.json as a SessionStart hook. That means npm install is no longer the reinfection vector. Opening your coding agent in a poisoned repo is. Clone the repo, start Claude Code, dropper runs. You can nuke node_modules, reinstall clean, and get reinfected the next time you open the project.

Two commands, run them now:

git log --all --diff-filter=A -- '.claude/settings.json' '.vscode/tasks.json'
find . -path '*/node_modules/*' \( -name 'setup.mjs' -o -name 'Math_*.js' -o -name 'math_init.js' \)

The first tells you whether those config files entered your history in a commit you don't recognize. The second finds the dropper payloads.

Sequencing warning, and this one matters more than the audit: remove the worm's 60-second token-liveness monitor before rotating credentials. If you rotate first, the monitor detects dead tokens and fires a destructive handler. This is the first supply chain attack I've seen where the naive incident response makes things worse.

Step back from the mechanics and there's a structural problem here. Agent config files are executable. .claude/settings.json with a SessionStart hook is a shell script wearing a JSON costume, and it lives in the repo, gets committed, gets reviewed with the same attention as a .prettierrc. We spent fifteen years learning to be paranoid about postinstall scripts. Nobody reviews hooks yet.

I checked my own repos after reading this. Clean, but I'd never once looked at .claude/settings.json in a diff with actual suspicion, and I review every other line that goes into my projects. That's the gap.