The npm Worm Targeting Claude & VS Code

Your VS Code secrets were just stolen by npm. Yes, you heard that correctly. While the tech world worries about AI safety and hypothetical robot takeovers, the real threat is sitting right inside your package dot JSON files. It's just waiting for the moment you run npm install—which, let's be honest, we all do without looking. This is the ChainDrop supply chain attack. It's a masterclass in exploiting developer oversight. We trust package managers to make our lives easier, but they also create massive blind spots. In this exploit, a compromised npm package runs a malicious preinstall hook using the bun runtime. It's specifically designed to hunt down Claude Code and VS Code directories on your local machine. It doesn't just break your build. It exfiltrates your cloud credentials, AWS keys, and NPM tokens directly to a remote server. You thought your local sandbox environment was secure, but you actually invited the intruder right past your firewall. To defend your pipelines against this, you need to implement three immediate checks. First, audit your system for the Math_Symbol.js payload. This is the signature file of the malware. If it's present in your dependency tree, you must assume your environment is already compromised. Second, secure your installation pipeline by disabling preinstall hooks entirely. You can do this by running npm install with the ignore scripts flag. This simple configuration change shuts down the primary execution vector of the attack. Third, stop storing high-privilege credentials in plaintext. Clean up your environment variables and restrict where VS Code and Claude Code store session tokens. If a dependency can read it, a hacker can steal it. Stop assuming your developer tools are inherently secure. Check your active projects for malicious scripts today, lock down your credentials, and subscribe for more authoritative security breakdowns.