{"slug": "a-supply-chain-worm-wrote-itself-into-claude-code-s-hook-files-to-survive", "title": "A Supply-Chain Worm Wrote Itself Into Claude Code's Hook Files to Survive Credential Rotation", "summary": "Microsoft's security research team tracked a campaign called 'ChainDrop' that took over an npm maintainer account and published trojanized releases across more than 400 packages, harvesting credentials from developer and CI/CD environments. The worm used stolen GitHub credentials to commit malicious hook files into victims' repositories, enabling it to survive credential rotation by auto-executing in Claude Code and VS Code sessions.", "body_md": "Rotating your credentials and removing a poisoned package is supposed to end an npm supply-chain compromise. In early August 2026, one worm made sure it didn't have to.\n\nMicrosoft's security research team tracked a campaign it calls \"ChainDrop\" — reported elsewhere as the keyv/cacheable compromise, or \"Mini Shai-Hulud\" — that took over an npm maintainer account and published trojanized releases across more than 400 packages from unrelated publishers, starting around August 4, 2026. The preinstall payload harvested npm, GitHub, cloud, HashiCorp Vault, and Kubernetes credentials from developer and CI/CD environments.\n\nThat alone is a bad week. What makes it a StupidLLM incident is what the worm did with the GitHub credentials it stole: it used them to commit `.claude/settings.json`\n\nand `.claude/setup.mjs`\n\ndirectly into victims' repository branches — plus matching `.vscode/tasks.json`\n\nand `.vscode/setup.mjs`\n\nfiles for VS Code's task runner. No developer action triggered this. It happened to repos the worm already had write access to, independent of anyone running `npm install`\n\nagain.\n\nClaude Code executes hooks declared in `.claude/settings.json`\n\nautomatically whenever it starts a session in that repository — no separate prompt confirming the hook file exists or asking whether you trust its contents. So a developer who did everything right — rotated every credential, pinned a clean package version, ran their normal incident response — could still have the malware fire again the moment they next opened the same repository in Claude Code.\n\nThe mechanism isn't a bug in Claude Code's code. It's a legitimate feature (automatic hook execution on session start) built on an assumption — that anything committed to a repo's `.claude/`\n\ndirectory is trustworthy — that a worm with write access to that repo is specifically positioned to defeat. The same trick against `.vscode/tasks.json`\n\nsays this wasn't a Claude-Code-specific idea; it's a generalizable technique against any tool that auto-executes config from a repo it's opened in.\n\nMicrosoft's writeup is a firsthand technical analysis: it names the affected package count, the credential categories targeted, and the specific hook/config file paths and persistence logic used against Claude Code and VS Code. It does not publish a per-victim or per-organization casualty count, and StupidLLM's incident record does not repeat the \"294,842 secrets from 6,943 machines\" figure that circulated elsewhere — that number could not be corroborated against a primary source, so it's left out.\n\nFull incident record, severity scoring, and source: [STUPID-2026-0085](https://www.stupidllm.com/incident/STUPID-2026-0085/)\n\nThis is one of 85+ verified, severity-scored AI agent incidents documented at [StupidLLM](https://www.stupidllm.com/incident/STUPID-2026-0085/), an open incident database for AI coding agent failures.", "url": "https://wpnews.pro/news/a-supply-chain-worm-wrote-itself-into-claude-code-s-hook-files-to-survive", "canonical_source": "https://dev.to/ramdai_bista/a-supply-chain-worm-wrote-itself-into-claude-codes-hook-files-to-survive-credential-rotation-5ce4", "published_at": "2026-08-23 13:21:00+00:00", "updated_at": "2026-08-23 13:43:33.807293+00:00", "lang": "en", "topics": ["ai-safety", "ai-ethics", "ai-agents", "developer-tools"], "entities": ["Microsoft", "Claude Code", "VS Code", "npm", "GitHub", "HashiCorp Vault", "Kubernetes", "ChainDrop"], "alternates": {"html": "https://wpnews.pro/news/a-supply-chain-worm-wrote-itself-into-claude-code-s-hook-files-to-survive", "markdown": "https://wpnews.pro/news/a-supply-chain-worm-wrote-itself-into-claude-code-s-hook-files-to-survive.md", "text": "https://wpnews.pro/news/a-supply-chain-worm-wrote-itself-into-claude-code-s-hook-files-to-survive.txt", "jsonld": "https://wpnews.pro/news/a-supply-chain-worm-wrote-itself-into-claude-code-s-hook-files-to-survive.jsonld"}}