Worm Infects Hundreds of npm Packages, Stealing Credentials and Planting VS Code Hooks
A sophisticated npm worm has compromised hundreds of packages, including those in the Keyv and Cacheable namespaces, spreading malicious code and implanting hooks for VS Code and potentially Claude.
A credential-stealing npm worm, first detected in [email protected], has spread across hundreds of packages, impacting multiple organizations. Security researchers have identified a significant number of poisoned package versions, indicating a widespread supply-chain attack.
Initial reports from SafeDep documented 353 poisoned versions across 79 package names, while Aikido identified at least 868 packages across 1,381 versions. The malware utilizes a preinstall script to execute a credential-stealing bundle within developer and continuous integration (CI) environments. This bundle is capable of harvesting sensitive information, including repository, package registry, cloud, and private-key material, and then leverages available npm publishing access to further poison other packages.
Beyond credential theft, the compromised Keyv repository also contains hooks specifically designed for Claude Code and Visual Studio Code (VS Code). These hooks can execute the malicious payload once a user trusts the workspace or permits project configuration, posing a significant risk to development environments.
Security experts advise that any workstation or runner that executed an affected version should be considered credential-exposed. Responders are urged to remove the malware's credential-revocation watcher before rotating exposed tokens and keys, as rotating first could inadvertently trigger an attacker-supplied local handler. While npm version 12 blocks unapproved dependency lifecycle scripts by default, older npm clients and other installation methods that permit these scripts remain vulnerable.
The initial malicious release, [email protected], introduced node setup.mjs as a preinstall command and included setup.mjs and Math_Symbol.js within the package. This stage checks for the Bun runtime, downloads a specific version if necessary, and then executes a compiled bundle that harvests various types of sensitive data, including GitHub, npm, cloud, Vault, Kubernetes, database, and private-key material. It also installs a token-revocation watcher and contains machinery for publishing packages under a compromised npm identity.
As the npm registry rapidly changed, with earlier versions being restored as 'latest' for some packages, determining a fixed campaign-wide list of compromised packages proved challenging. Exposure checks must rely on exact package names, resolved versions, and lockfiles rather than cached lists of current tags. The reported totals from SafeDep and Aikido reflect the number of malicious package artifacts, not necessarily the number of compromised systems.
A secondary execution path exists through the .claude/settings.json file, which contains a SessionStart hook calling .vscode/setup.mjs. Similarly, .vscode/tasks.json includes an Environment Setup task that runs on folder open, also calling .claude/setup.mjs. While these files enable payload execution from a checked-out repository, they do not run unconditionally in all default environments. VS Code prompts users before allowing automatic tasks in untrusted workspaces, and Claude Code applies workspace trust to repository-supplied settings.
Compounding the issue, the poisoned Keyv release passed through the project's legitimate GitHub Actions release workflow, resulting in valid OpenID Connect (OIDC) and SLSA provenance. This attestation correctly identified the build process but could not guarantee the safety of the source code entering it. The same payload and hooks have been observed in previous compromises, indicating a persistent threat actor or evolving attack techniques within the npm ecosystem.
This new report details that the worm has now compromised over 2,000 versions across 444 distinct npm packages, significantly expanding its reach. It specifically targets and steals cloud and CI credentials, including those from HashiCorp Vault, Kubernetes, and GitHub Actions, by exploiting exposed publisher tokens within trusted dependencies. The malware also demonstrates the ability to generate new Sigstore provenance records for trojanized releases, creating signed, verifiable links to a compromised build process.
Microsoft Threat Intelligence has detailed a significant npm supply chain attack involving over 400 packages, which they've identified as a variant of the Mini Shai-Hulud worm. This sophisticated malware, delivered via an obfuscated Bun-based JavaScript payload, targets developer workstations and CI/CD environments to steal credentials for npm, GitHub, AWS, and other services. The worm can then use these stolen identities to republish compromised packages with its malicious payload, inject files into repositories for persistence, and spread further through developer tools like Claude and Visual Studio Code.
The ChainDrop campaign, an evolution of the Mini Shai-Hulud worm, has escalated the attack by compromising over 400 NPM packages, including those in the keyv and cacheable namespaces. This new iteration features an information stealer that exfiltrates secrets to dynamic HTTPS endpoints or attacker-controlled GitHub repositories, and uses stolen NPM and GitHub credentials to publish poisoned versions of other packages, significantly expanding its reach and propagation capabilities.
This new report identifies the ongoing npm supply chain attack as a Mini Shai-Hulud campaign, a self-spreading malware operation specifically designed to steal access tokens. The attackers are leveraging multiple stolen publishing tokens to alter releases from other maintainers, creating a worm-like propagation mechanism. The incident has rapidly expanded, affecting 2,234 package artifacts across 444 unique packages, highlighting the significant downstream risk posed by a single compromised maintainer account.
The ChainDrop worm introduces a novel command and control (C2) mechanism by leveraging Ethereum smart contracts for routing, allowing attackers to reconfigure the entire C2 infrastructure with a single blockchain transaction. Additionally, the worm exhibits persistence by targeting developer workstations and AI coding tools, and it can extract temporary credentials from GitHub Actions runner memory.
The ChainDrop worm has expanded its reach to over 400 npm packages, significantly increasing the potential impact of this supply chain attack. This latest development reveals that the worm not only steals GitHub and cloud credentials but also uses compromised npm publishing accounts to further propagate itself by republishing malicious versions of other packages. Researchers have identified hundreds of millions of weekly downloads for affected packages, underscoring the widespread risk to developer systems and build environments.
This new analysis of the ChainDrop worm, a variant of Shai-Hulud, reveals its sophisticated propagation methods that bypass traditional source code repository checks. Instead of altering source commits, ChainDrop infects tarball archives, which are then used to self-replicate by rebuilding packages with malicious payloads. Furthermore, it targets Git credentials to directly inject malicious configurations into branches, which can then trigger credential harvesting when developers open these repositories in IDEs like VS Code or Claude Code.
This new report details how the ChainDrop campaign, also tracked by some researchers as Mini Shai-Hulud, significantly expanded its reach by compromising a GitHub account for the Keyv caching library. Attackers leveraged stolen npm tokens to publish malicious releases across 444 packages, impacting over two billion monthly installs, and crucially, introduced repository configurations designed to execute code upon opening projects in VS Code or starting Claude Code sessions, bypassing traditional dependency scanning.