Rotating your credentials and removing a poisoned package is supposed to end an npm supply-chain compromise. In early August 2026, one worm made sure it didn't have to. What happened Microsoft's security research team tracked a campaign it calls "ChainDrop" β€” reported elsewhere as the keyv/cach...

Source: [Dev.to](https://dev.to/ramdai_bista/a-supply-chain-worm-wrote-itself-into-claude-codes-hook-files-to-survive-credential-rotation-5ce4)

Sponsored