ChainDrop's npm worm reinfects machines through Claude Code hooks

ChainDrop, a self-propagating npm worm, poisoned 444 packages and 2,212 versions in under four hours on August 4, per Microsoft Threat Intelligence.

Anyone who installed one of the 444 packages has a hook waiting to fire the next time they open that repo. The starting package alone had 150 million weekly downloads before flat-cache and file-entry-cache got pulled in too.

Unit 42, StepSecurity, Expel, and Microsoft corroborated the find with advisories on August 4 and 5. The worm steals npm, GitHub, AWS, Vault, and Stripe tokens, plus AI-assistant credentials.

It also writes a SessionStart hook into .claude/settings.json and a matching entry into .vscode/tasks.json. Opening the project in a coding agent relaunches the dropper, so npm install isn't the reinfection trigger anymore.

Zero Hunt's writeup lists two checks. Run git log --all --diff-filter=A -- '.claude/settings.json' '.vscode/tasks.json' to see when the hook landed. Search node_modules for setup.mjs, Math_*.js, and math_init.js to spot the dropper's files.

The order isn't optional. ChainDrop runs a 60-second token-liveness monitor, and killing it has to happen before rotating stolen credentials, per the advisory, or its handler fires destructively.

A separate report found attackers scanning for exposed MCP servers, 49 distinct IPs over 14 days. Another documented GitHub's new MCP server allowlists for enterprises, which fail closed by default.