ChainDrop Worm Uses .claude/settings.json Hooks to Survive Credential

ChainDrop's .claude/settings.json hooks auto-execute on session start, surviving credential rotation. Claude Code users must audit hook files, pin trusted configs, and restrict repo write access.

Key Takeaways

• ChainDrop's .claude/settings.json hooks auto-execute on session start, surviving credential rotation.
• Claude Code users must audit hook files, pin trusted configs, and restrict repo write access.

What Changed — The ChainDrop Worm Exploits Claude Code's Hook System

Microsoft's security team tracked "ChainDrop" (STUPID-2026-0085), a supply-chain worm that took over an npm maintainer account and published trojanized releases across 400+ packages starting August 4, 2026. The preinstall payload harvested npm, GitHub, cloud, HashiCorp Vault, and Kubernetes credentials from developer and CI/CD environments.

What makes this a Claude Code-specific threat: the worm used stolen GitHub credentials to commit .claude/settings.json and .claude/setup.mjs directly into victims' repository branches. No developer action triggered this — it happened to repos the worm already had write access to, independent of anyone running npm install again.

What It Means For You — Your Hooks Auto-Execute Without Confirmation

Claude Code executes hooks declared in .claude/settings.json automatically whenever it starts a session in that repository. There's no prompt confirming the hook file exists or asking whether you trust its contents.

This is a legitimate feature — automatic hook execution on session start — built on the assumption that anything committed to a repo's .claude/ directory is trustworthy. A worm with write access to that repo is specifically positioned to defeat that assumption.

The same technique was used against .vscode/tasks.json, proving this is a generalizable attack against any tool that auto-executes config from a repo it's opened in.

Try It Now — Audit and Lock Down Your Hook Files

Step 1: Audit your current repos

# Find all .claude/settings.json files in your repos
find ~/code -name "settings.json" -path "*/.claude/*" 2>/dev/null

# Check for unexpected hooks
cat ~/code/your-repo/.claude/settings.json

Look for hooks that execute scripts, curl commands, or reference external URLs. Legitimate hooks might run linters or formatters — malicious ones often download payloads or exfiltrate data.

Step 2: Pin trusted hooks

Add this to your global ~/.claude/settings.json to restrict what hooks can do:

{
  "permissions": {
    "allow": ["Bash(npm run lint)", "Bash(git status)"],
    "deny": ["Bash(curl *)", "Bash(wget *)", "Bash(node setup.mjs)"]
  }
}

Step 3: Verify repo integrity before opening

# Check for unexpected .claude/ files
git log --all --oneline -- .claude/
git diff HEAD~1 HEAD -- .claude/

Step 4: Restrict write access

The worm only succeeded because it had write access to repos. Use read-only tokens for CI/CD, and review GitHub fine-grained PATs that have Contents: Write permission on repos you don't actively push to.

The Bottom Line

ChainDrop exploits a fundamental trust assumption in Claude Code's hook system. The feature is powerful — but it's also a persistence vector. Audit your .claude/ directories today, pin your hook permissions, and treat any unexpected file in that directory as a potential compromise.

Source: dev.to

[Updated 24 Aug via devto_claudecode]

The worm also planted matching .vscode/tasks.json and .vscode/setup.mjs files alongside the Claude Code hooks, extending its persistence to VS Code's task runner — a move Microsoft's analysis says proves the technique is generalizable beyond Claude Code. The same campaign is also known as the keyv/cacheable compromise or "Mini Shai-Hulud." [per StupidLLM] Notably, the widely circulated figure of 294,842 secrets stolen from 6,943 machines could not be corroborated against a primary source and was excluded from the official incident record.

Originally published on gentic.news