ChainDrop

A self-propagating npm worm that, in under four hours, poisoned hundreds of packages sitting underneath most of the JavaScript ecosystem. It stole credentials, republished itself using the tokens it stole, and — the part this page is about — wrote itself into the configuration files that AI coding agents read on startup.

What happened

On August 4, 2026, an attacker compromised the GitHub account of the maintainer behind keyv, cacheable, flat-cache and file-entry-cache — four libraries almost nobody installs deliberately and almost everybody installs anyway, as transitive dependencies of ordinary tooling. StepSecurity notes the commits were unsigned and pushed directly to main, indicating API access to the account rather than a stolen npm token.

The poisoned release went out through the project’s own GitHub Actions release workflow. That detail matters more than it first appears: because the malicious code travelled the legitimate pipeline, it arrived carrying valid OIDC and SLSA provenance attestations, and the compromised commit displayed a green GitHub-verified badge naming github-actions[bot] as its author. Supply-chain provenance answered the question it was built to answer — this artifact really was produced by that pipeline — and that question turned out not to be the one anybody needed answered.

Counts differ by researcher and by the hour they stopped counting. StepSecurity and Microsoft report 444 packages across 2,212 versions; SafeDep reports 1,684 versions across 420 names; Aikido reports 868 packages across 1,381 versions. The disagreement is a property of measuring a worm while it is still running, not a contradiction.

The infection chain

A preinstall hook in package.json runs node setup.mjs— before installation even finishes. The dropper detects OS and architecture, then downloads the genuine Bun runtime, v1.3.13, from Bun’s official GitHub releases. The network indicator points at github.com, not at attacker infrastructure. It then executes a ~728 KB obfuscated bundle through Bun, sidestepping anything watching Node specifically, and deletes the runtime afterwards.

The payload harvests across roughly 140 filesystem locations: npm and GitHub tokens, AWS, Azure and GCP credentials, Kubernetes configs, Vault tokens, SSH keys, shell history. In CI it scrapes GitHub Actions runner memory for "isSecret":true fragments. It exits on Russian-language systems.

Exfiltration is gzip-compressed, AES-256-GCM encrypted under a random per-run key, that key wrapped with an embedded RSA public key — so only the operator can read what was taken, even if you capture it. The destination domain is not hardcoded. It is fetched from an Ethereum mainnet contract via eth_call, a technique known as EtherHiding, with GitHub commit-search queries as a fallback. There is no domain to sinkhole because the operator rotates it on-chain.

Then it propagates. Stolen npm tokens are checked for write permission and 2FA-bypass capability, the victim’s publishable packages are enumerated, each tarball is downloaded, injected, version-bumped, and republished — with freshly generated provenance. Microsoft’s summary of the blast radius is the line worth keeping: one stolen token can produce malicious patch releases across every package available to that publisher.

The part that concerns agents

Alongside the npm propagation, the worm committed two files into the repositories it reached — on all branches, via the GitHub GraphQL API:

Each points at a dropper the other directory carries. Neither needs npm install to run again. Opening the folder in VS Code re-executes the payload. Starting a Claude Code session in it re-executes the payload. The infection now outlives the dependency that delivered it: you can remove the poisoned package, purge the cache, pin a clean version, and the hook is still sitting in your repository waiting for the next session to start. It also ships to every developer who clones the repo, because it is committed to source control.

This is not incidental. The worm separately targets .claude/credentials.json, .cursor/credentials.json, .openai/auth.json and .anthropic/auth.json. Agent credentials are now a harvest category alongside AWS keys, and agent config is now a persistence surface alongside systemd. Aikido ties the same setup.mjs filename, the same Bun 1.3.13 download and the same two hooks to the April 2026 lightning PyPI compromise — this is a reused, maintained capability, not a one-off.

There is also a component that punishes the correct response. The worm installs ~/.local/bin/gh-token-monitor.sh with a systemd user service or a macOS LaunchAgent, checks the stolen token every 60 seconds for 24 hours, and fires an attacker handler when the token is revoked. SafeDep’s guidance follows from it: rotate credentials before revoking, and remove the watcher first.

Timeline

All times UTC, August 4, 2026, per StepSecurity and Datadog.

Roughly 34 minutes from the first malicious publish to the worm publishing on its own, and 42 to the first public alarm. Any control that depends on a human reading an advisory was going to lose that race.

Which control applies

Honest scope first, because the temptation to overclaim here is obvious. Agent Wormhole would not have stopped the compromise. It does not inspect npm tarballs, it does not sandbox preinstall, and it has nothing to say about a stolen maintainer account. By the time the dropper runs, your credentials are gone. Nothing on this site changes that.

What it addresses is the second half — persistence. The two hooks above are the exact shape the autostartscanner was written for, after Miasma used the same mechanism across 73 Microsoft repositories in June 2026. Run against a repository carrying ChainDrop’s artifacts, both are flagged:

The prevention half is wormhole harden, and the reason it works is unintuitive: it creates these files when they are absent, empty and read-only. You cannot chmoda file that does not exist, and ChainDrop — like Miasma — persists by creating configuration in repositories that never had it. With inert 0444 placeholders in place, the worm’s write is refused by the operating system rather than reported after the fact.

Two caveats stated plainly. Hardening does not contain an agent running as root, which is common in CI and in default Docker images — root ignores the mode bit. And a scanner that reports a hook after it has fired has told you about an incident, not prevented one; the creation-blocking half is the one that matters here.

Worth naming as a finding rather than a feature: testing the tool against this incident surfaced a real bug in it. harden checked whether any existing config needed locking, found none, and exited reporting nothing to do — before it ever consulted the list of paths to pre-create. A repository with no writable agent config is precisely the case where pre-creation is the only control that does anything, and it was the case being skipped. Fixed, with a regression test verified to fail against the previous code.

What to actually do

The vendor guidance below is not ours and does not involve this tool. It is the part that matters most, so it goes first.

Why this one is different

The other pages in this section describe agents talked into moving money. This one is not that. No model was injected, no agent was persuaded of anything — ChainDrop is ordinary malware in the sense that it runs code, steals secrets, and copies itself, and it would have worked in 2015.

What is new is where it chose to live. An agent config file is a uniquely good hiding place: it executes automatically, it survives uninstalling the thing that put it there, it is committed to source control so it spreads to every clone, and — unlike a systemd unit — almost nobody reviews it, because until recently there was nothing dangerous to find. ChainDrop treated agent tooling as infrastructure worth persisting in and agent credentials as secrets worth stealing. That is the shift, and it is now attested by Microsoft, Datadog, StepSecurity, Aikido and Wiz rather than by a research preprint.

Which also fixes the honest gap named on the index page. Self-replication in agent-adjacent software is no longer lab-only, and the config-persistence mechanic is no longer a single incident. The combination still missing from the public record is a self-replicating payload that steals money on-chain — ChainDrop stole wallet files, but it stole them the way it stole SSH keys, not by talking an agent into a payment. That join has not happened yet, and saying otherwise would be the overclaim these pages exist to avoid.

Sources

Package counts vary between these reports and the range is given above rather than a single convenient number. Where a detail appears in only one source — the token-monitor punishment handler, the Russian-language exit, the PyPI overlap — the source is named inline.