Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-08 · high
Microsoft counted 444 packages poisoned in under four hours, and rotating stolen credentials in the wrong order trips a destructive handler.
Why now: Zero Hunt's writeup and the corroborating advisories from Microsoft, Unit 42, StepSecurity, and Expel all landed August 4 and 5.
ChainDrop, a self-propagating npm worm, poisoned 444 packages and 2,212 versions in under four hours on August 4, per Microsoft Threat Intelligence.
Anyone who installed one of the 444 packages has a hook waiting to fire the next time they open that repo. The starting package alone had 150 million weekly downloads before flat-cache and file-entry-cache got pulled in too.
Unit 42, StepSecurity, Expel, and Microsoft corroborated the find with advisories on August 4 and 5. The worm steals npm, GitHub, AWS, Vault, and Stripe tokens, plus AI-assistant credentials.
It also writes a SessionStart hook into .claude/settings.json and a matching entry into .vscode/tasks.json. Opening the project in a coding agent relaunches the dropper, so npm install isn't the reinfection trigger anymore.
Zero Hunt's writeup lists two checks. Run git log --all --diff-filter=A -- '.claude/settings.json' '.vscode/tasks.json' to see when the hook landed. Search node_modules for setup.mjs, Math_*.js, and math_init.js to spot the dropper's files.
The order isn't optional. ChainDrop runs a 60-second token-liveness monitor, and killing it has to happen before rotating stolen credentials, per the advisory, or its handler fires destructively.
A separate report found attackers scanning for exposed MCP servers, 49 distinct IPs over 14 days. Another documented GitHub's new MCP server allowlists for enterprises, which fail closed by default.
Each link below shares sources, entities, or timing with this story.
Microsoft Threat Intelligence disclosed ChainDrop on August 4: a self-propagating npm worm that poisoned 444 packages across 2,212 versions in under four hours, starting from [redacted] at 150M weekly downloads, plus flat-cache and file-entry-cache. Corroborated by Unit 42, St...
The default is 200 search calls and 200 subagent spawns per session, adjustable through an environment variable when you hit it.
Simon Willison found 563 Rust filenames in the binary, tracing the swap to a June 17 update.
Two of the six hid commands from the approval dialog itself, using tab padding, invisible Unicode, and split Bash strings.
The release also adds a command that migrates Python projects off the old anthropic 0.x SDK and stops WebFetch from serving stale content all session.
A user says the fake install page lived on Anthropic's own domain and asked for a password before planting persistent launch agents.
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.