ChainDrop poisoned software packages and planted malicious startup commands for Claude Code and VS Code.
Source: Datadog Security LabsActivity and initial investigation reports: August 4. Maintainer account: August 31.
A maintainer’s account was used to change software that other developers relied on.
Jared WrayMalicious project settings could run code when Claude Code started or VS Code opened the project.
Datadog Security LabsGitHub and npm removed infected releases. Cleanup of previously affected machines is a separate task.
Jared WrayEditorial analogy: imagine a shared toolbox arriving with a trap attached to its lid. The trap is part of the equipment; it does not require the person using the tools to agree to an attacker’s request.
An analogy for the mechanism; not an additional claim about the incident.Poisoned releases passed through the projects’ genuine publishing workflow. Jared Wray
StepSecurity observed malicious network activity in Backstage build jobs, without evidence of credential loss there. StepSecurity
Recovered configuration shows intended AI-tool execution. Actual activation of those hooks, or theft and use of particular AI-service credentials, is not established in the reviewed reporting.
The reviewed evidence does not establish AI authorship or AI-directed execution. Package downloads are not victim counts.
The maintainer believes an old access token was used; exactly how it was obtained remains uncertain.
Editorial lesson: AI software has ordinary software settings, files and permissions around it. Protecting those parts matters alongside how a model responds to instructions. A trusted-looking release record still requires attention to what was released.
An attacker altered the projects; the malware then propagated automatically. Datadog Security Labs
The maintainer says GitHub and npm stopped propagation and removed infected releases within about seven hours. Jared Wray
Editorial connections for maintainers and organizations using developer tools. These are relevant practices, not findings about missing controls or guarantees of prevention.
Check new dependencies and changes to startup tasks, editor settings and AI-tool settings before trusting a project. Separate package testing from sensitive work.
A record of where software was built does not establish that its contents are safe. A clean new release does not repair an already affected machine.
Use narrowly scoped credentials, separate publishing access from routine development, and make exposed credentials easy to revoke and replace.
Replacing credentials limits future access. It does not retrieve information already copied or remove installed malware.
Editorial connections to relevant controls, not evidence that a particular technology would have prevented this case. Each guide links to the security guidance behind its recommendations.
Explore the full AI security frameworkExplore more original accounts in the source report library ↗.
These are source-reported findings. An independent assessment, when available, is labeled explicitly.
01Read this case’s update history →
Reviewed Sep 20, 2026 · Editorial methodology · Structured data