Rotating your credentials and removing a poisoned package is supposed to end an npm supply-chain compromise. In early August 2026, one worm made sure it didn't have to.
What happened
Microsoft's security research team tracked a campaign it calls "ChainDrop" — reported elsewhere as the keyv/cacheable compromise, or "Mini Shai-Hulud" — that took over an npm maintainer account and published trojanized releases across more than 400 packages from unrelated publishers, starting around August 4, 2026. The preinstall payload harvested npm, GitHub, cloud, HashiCorp Vault, and Kubernetes credentials from developer and CI/CD environments.
That alone is a bad week. What makes it a StupidLLM incident is what the worm did with the GitHub credentials it stole: it used them to commit .claude/settings.json and .claude/setup.mjs directly into victims' repository branches — plus matching .vscode/tasks.json and .vscode/setup.mjs files for VS Code's task runner. No developer action triggered this. It happened to repos the worm already had write access to, independent of anyone running npm install again.
Why the persistence mechanism matters
Claude Code executes hooks declared in .claude/settings.json automatically whenever it starts a session in that repository — no separate prompt confirming the hook file exists or asking whether you trust its contents. So a developer who did everything right — rotated every credential, pinned a clean package version, ran their normal incident response — could still have the malware fire again the moment they next opened the same repository in Claude Code.
The mechanism isn't a bug in Claude Code's code. It's a legitimate feature (automatic hook execution on session start) built on an assumption — that anything committed to a repo's .claude/ directory is trustworthy — that a worm with write access to that repo is specifically positioned to defeat. The same trick against .vscode/tasks.json says this wasn't a Claude-Code-specific idea; it's a generalizable technique against any tool that auto-executes config from a repo it's opened in.
What the source establishes — and what it doesn't
Microsoft's writeup is a firsthand technical analysis: it names the affected package count, the credential categories targeted, and the specific hook/config file paths and persistence logic used against Claude Code and VS Code. It does not publish a per-victim or per-organization casualty count, and StupidLLM's incident record does not repeat the "294,842 secrets from 6,943 machines" figure that circulated elsewhere — that number could not be corroborated against a primary source, so it's left out.
Status
Full incident record, severity scoring, and source: STUPID-2026-0085
This is one of 85+ verified, severity-scored AI agent incidents documented at StupidLLM, an open incident database for AI coding agent failures.
