ChainDrop npm worm hijacks 444 packages with 2B monthly downloads via AI agent hooks

A newly documented npm supply-chain worm called ChainDrop hijacked publishing access to 444 packages with a combined roughly 2 billion downloads per month, using the trust developers place in AI coding tools as its launch mechanism.

According to GitGuardian, in an analysis published on dev.to, ChainDrop is the latest variant of the "Shai-Hulud" family of npm worms. Microsoft, cited in the write-up, puts the impact at 444 packages from multiple publishers, collectively downloaded about 2 billion times a month, including widely used dependencies such as keyv, flat-cache and cache-manager.

How the worm propagates

Once inside a compromised developer machine or CI/CD system, ChainDrop automatically searches for credentials covering npm, GitHub, cloud environments, Kubernetes and Vault, among other targets. When it finds working npm publishing access, it enumerates every package the compromised identity can publish, modifies each package's tarball, increments the version number and republishes it carrying the malicious payload. A single set of stolen credentials therefore becomes the starting point for a fresh wave of infected releases.

Stolen GitHub credentials extend the reach further: GitGuardian says the worm can push malicious configuration into branches of any repository the compromised identity can access.

Ordinary developer actions become the trigger

The notable twist is where the worm plants its launch mechanism. Researchers found malicious configuration placed inside Claude Code and Visual Studio Code projects. In Claude Code, a SessionStart hook fires the dropper the moment an AI coding session begins. In VS Code, a folderOpen task runs as soon as a developer opens the infected repository.

That means everyday actions — opening a branch, starting an AI-assisted session — can set the attack running inside an environment the developer already trusts. GitGuardian stresses that the whole sequence plays out in seconds, far faster than a human defender could reasonably react.

Machine-speed credential abuse

The deeper shift the analysis highlights is one of timing. Older attack models assumed discrete stages — steal credentials, review what was found, decide the next move — separated by human deliberation, which gave defenders a human-scale reaction window. Agentic automation removes the pauses between those turns: discovery can flow directly into testing, authentication, enumeration, exfiltration and propagation without waiting for a person to make a decision.

Valid, long-lived plaintext credentials make this especially dangerous, GitGuardian notes, because every automated step looks like legitimate authenticated access to the service on the receiving end. Exfiltration still occurs and humans can still plan later phases of an intrusion, but a large amount of damage now happens before anyone needs to be involved again.

The company argues that the AI runtime has effectively become part of the execution environment and therefore part of the attack surface, since developers increasingly grant coding agents access to repositories, local files, terminals, MCP servers and the credentials those systems depend on.

Why it matters

For anyone building on npm, the incident underlines how quickly popular transitive dependencies can be weaponized after a maintainer's credentials leak. Rotating publishing tokens, moving to short-lived credentials, and treating CI systems and developer endpoints as high-value targets all shrink the blast radius of a compromise.

More broadly, ChainDrop shows that AI coding assistants are no longer neutral tooling in the threat model — their hooks and autonomous permissions can be abused as a reliable execution trigger. Security programs built on detect, investigate, then remediate assume a window of time that machine-speed attacks increasingly consume. GitGuardian's proposed answer is to act earlier: find exposed secrets across the development lifecycle, prioritise them by validity and severity, and use endpoint protection plus AI hooks to stop agents from reaching secrets in the first place. Whatever remedy a team chooses, the underlying point stands — once execution begins, defenders no longer get a human-speed turn to respond.