Quirin Schlegel

Work Writing Vault Six-Pagers Newsletter Contact

AI Engineer · Quirin SchlegelBerlin · 2026.10

Loading

© 2026 Quirin Schlegel · Built in public

Writing Vault Six-Pagers Newsletter RSS Conformity Privacy

GitHub LinkedIn X Email

Signed, and still yours — the npm worm that lives in your agent config

ChainDrop persists via AI coding-agent configuration files that no SBOM enumerates and no provenance attestation covers; the malicious releases were cryptographically attested by the projects' own release workflows, so signature validity proved build origin rather than authorisation.

6 August 20267 verified claims6 sources

Your dependency scanner reads package.json. The worm that hit npm on Tuesday persists somewhere it will never look — inside your coding agent's config.

On 4 August Microsoft Threat Intelligence published its analysis of ChainDrop — tracked by Elastic as the return of Shai-Hulud. Eleven packages were seeded directly, keyv 6.0.0, flat-cache and file-entry-cache among them. Aikido counted 444 compromised packages across 1,381 versions by 5 August, over two billion monthly installs combined. The number is still moving; treat any count you read as a timestamp, not a total.

That is the part the headlines got.

Here is the part that should change your engineering, not your incident report.

The payload does not only run at install. Microsoft describes it injecting into .claude/settings.json and .vscode/tasks.json across repository branches. StepSecurity names the exact hooks: SessionStart in the Claude settings, runOn folderOpen in the VS Code task. Each executes a copy of the dropper.

So the reinfection trigger is not npm install. It is opening the repository in your agent.

Then the second thing.

These releases were not forged. The attacker took the maintainer's GitHub account, pushed poisoned commits and tags, and let the projects' own release workflows publish through OIDC trusted publishing. The malicious versions carry valid provenance attestations. The signature was real. It attested where the build ran — not who authorised it.

Hold that next to the Cyber Resilience Act. Annex I Part II requires a software bill of materials "in a commonly used and machine-readable format covering at the very least the top-level dependencies".

.claude/settings.json is not a dependency. Not in your SBOM. Not covered by the attestation. And it executes.

What I'd do Monday:

1. Grep every repository for agent hook files — .claude/, .vscode/tasks.json, .cursor/, MCP server configs. Diff them against what you expect.

2. Put agent config under code review. Config that executes is code — currently reviewed by nobody.

3. Rotate credentials from a clean host. The infected one has your rotation in its shell history.

4. Move to npm CLI v12 and set min-release-age. You cannot review what you install minutes after publication.

The CRA's reporting duty starts 11 September, thirty-six days out; the bill of materials duty in December 2027. Neither has a field for the file that owns you.

Which files in your repo execute before you have read a single line of them?

#SupplyChainSecurity #AgenticAI #CyberResilienceAct #AIEngineering #Berlin

Evidence

What this rests on

Every factual claim in the edition above, stated on its own and checked before publication. If one of these is wrong, the argument is wrong — so they are listed where you can check them.

Microsoft Threat Intelligence published its ChainDrop analysis on 4 August 2026.
Why it mattersFixes the event date to the primary disclosure rather than to the aggregator coverage that followed it.
microsoftse2026chaindrop
The payload injects into .claude/settings.json, .claude/setup.mjs, .vscode/tasks.json and .vscode/setup.mjs across repository branches, creating a secondary infection route that can restart the payload after the original npm install has completed.
Why it mattersThe persistence route is the reason a clean `npm ci` does not end the incident. It changes remediation from dependency cleanup to repository inspection.
microsoftse2026chaindrop · aikidosecur2026keyv · stepsecurit2026chaindrop
The specific persistence mechanisms are a SessionStart hook in .claude/settings.json and a runOn: folderOpen task in .vscode/tasks.json, each executing a copy of the dropper.
Why it mattersNames the exact keys an engineer greps for on Monday morning. Without them the advice is unactionable.
stepsecurit2026chaindrop · microsoftse2026chaindrop
The malicious versions carried valid provenance attestations: the attacker compromised the maintainer's GitHub account, pushed poisoned commits and tags, and let the projects' own release workflows publish via OIDC trusted publishing, so the attestation proved build origin rather than authorisation.
Why it mattersProvenance and SLSA attestation are widely deployed as the control for exactly this attack. This shows the attestation was valid and still did not help, because it attests build origin rather than authorisation.
stepsecurit2026chaindrop
Aikido counted 444 compromised packages across 1,381 versions with over two billion combined monthly installs, as of its 5 August 2026 update.
Why it mattersGives the blast radius with a named source and a timestamp, so the reader can tell a snapshot from a total.
aikidosecur2026keyv
Eleven packages were seeded directly, including keyv 6.0.0, flat-cache 6.1.24, file-entry-cache 11.1.6, cacheable-request 13.0.20 and cache-manager 7.2.10.
Why it mattersThese are the packages a team actually has in its lockfile; the transitive ones are what make the count large.
aikidosecur2026keyv · stepsecurit2026chaindrop
The Cyber Resilience Act's Annex I Part II requires manufacturers to draw up a software bill of materials in a commonly used and machine-readable format covering at the very least the top-level dependencies of the product.
Why it mattersThe regulatory hook. The SBOM duty enumerates dependencies, and the persistence artefact is not one, so compliance and security diverge here.
europeancyb2022cyber

Sources

Tech Timesaggregator
BSides Las Vegas AI Track Warned of Agentic Worm Risk the Day Before C
Original Archived PDFretrieved 6 August 2026 · published 5 August 2026
StepSecurityprimary source
ChainDrop npm Worm- Bun-loaded CI-CD credential harvester with Ethereu
Original Archived PDFretrieved 6 August 2026 · published 4 August 2026
Microsoft Security Blogprimary source
ChainDrop supply chain compromise: Anatomy of a self-propagating worm
Original Archived PDFretrieved 6 August 2026 · published 4 August 2026
european-cyber-resilience-act.comsecondary
Cyber Resilience Act, Annex I — essential requirements
Original Archived PDFretrieved 6 August 2026 · published 15 September 2022
Aikido Securityprimary source
Keyv and friends compromised in npm supply chain attack
Original Archived PDFretrieved 6 August 2026 · published 4 August 2026
Elastic Security Labsprimary source
Shai-Hulud strikes again- CHAINDROP worm hits 400+ npm packages
Original Archived PDFretrieved 6 August 2026 · published 4 August 2026

Every source for this edition, as one PDF BibTeX — all editions

Corrections

What changed after publication

None. Two figures were withheld rather than corrected: the aggregate package count (sources disagree) and an 89-second publication-to-impact figure (second-hand account of a conference talk).