PulseAugur
EN
LIVE 00:45:41

Supply-chain worm exploits Claude Code and VS Code config for persistence

By PulseAugur Editorial · [1 sources] ·

A sophisticated supply-chain worm, dubbed ChainDrop or Mini Shai-Hulud, compromised over 400 npm packages, stealing credentials from developer and CI/CD environments. The worm uniquely leveraged stolen GitHub credentials to directly inject malicious configuration files into the `.claude/` directory of Claude Code and `.vscode/` directory for Visual Studio Code. This allowed the malware to persist and re-execute automatically when developers opened affected repositories in these tools, bypassing standard incident response measures like credential rotation. AI

IMPACT Highlights a novel attack vector targeting AI coding assistants, necessitating new security measures for developer tools.

RANK_REASON The item details a novel persistence mechanism for malware targeting specific developer tools, rather than a new release from a frontier AI lab.

Read on dev.to — Claude Code tag →

AI-generated summary · Google Gemini · from 1 sources. How we write summaries →

Supply-chain worm exploits Claude Code and VS Code config for persistence

How we ranked this

Signal score
0 / 100
Composite score across the factors below. Higher = stronger signal that this story matters right now.
Newsworthiness bucket
Tool
The item details a novel persistence mechanism for malware targeting specific developer tools, rather than a new release from a frontier AI lab.
Source corroboration
Single-source cluster
Only one publisher covered this so far. Single-source stories can still rank when the publisher is high-authority, but they lack cross-source corroboration.
Topics
product, safety
Editorial topic classification. Feeds into how the story surfaces on /topic/<slug> hub pages and into the per-entity coverage mix.
AI-industry relevance
High
Clearly on-topic for AI-industry coverage.
Story freshness
34 days old
Aged out of breaking-news scoring windows; ranking reflects the durable signal from the full source set.

Full methodology in our editorial standards.

COVERAGE [1]

  1. dev.to — Claude Code tag TIER_1 English(EN) · Ramdai Bista ·

    A Supply-Chain Worm Wrote Itself Into Claude Code's Hook Files to Survive Credential Rotation

    <p>Rotating your credentials and removing a poisoned package is supposed to end an npm supply-chain compromise. In early August 2026, one worm made sure it didn't have to.</p> <h2> What happened </h2> <p>Microsoft's security research team tracked a campaign it calls "ChainDrop" —…

RELATED ENTITIES

RELATED TOPICS