ChainDrop executes from a checked-in agent config the moment a coding session starts

The write and the run are separate events. A checkout puts a file in the working tree and nothing happens yet. Execution comes with the next ordinary action: GitGuardian says researchers found malicious configuration in Claude Code and Visual Studio Code projects, where a SessionStart hook launched the dropper when an AI coding session began ^[4][2], and a folderOpen task ran when the developer opened the infected repository ^[3]. Both triggers sit outside the package install, so controls scoped to install scripts miss them ^[15].

The GitHub credential is the delivery half. GitGuardian says stolen GitHub credentials let the worm push malicious configuration into branches of repositories the compromised identity can reach ^[7]. The npm credential is the payload half: on finding usable publishing access, the worm enumerates every package available to that identity, modifies the tarballs, increments their versions and republishes them with the payload ^[6].

The 444-package count and the figure of roughly 2 billion downloads a month come from Microsoft, cited in GitGuardian's write-up ^[1]. Divide one by the other and you get about 4.5 million downloads per package per month ^[14]. That is arithmetic. The packages behind it each carry their own count. The named dependencies include keyv, flat-cache and cache-manager ^[8], which most projects acquire transitively, and the worm increments the version before republishing, so an install that resolves a range rather than a pinned version can pick up the new release ^[19].

GitGuardian wrote that "The whole attack is accomplished in seconds" and that there is no meaningful pause between discovery and use ^[9]. That is the vendor's description of the path, and the post does not include timing measurements ^[18]. If the credential is found and used inside one session, a rotation triggered by detection lands after the malicious versions are public, and those versions stay published once the token is rotated ^[16].

The post is also a product page. The controls it names are detection of exposed credentials across the SDLC, remediation prioritised by validity and severity, and Developer Endpoint Protection with AI hooks to prevent agents from accessing secrets ^[12]. GitGuardian also says the playbook depends on long-lived plaintext credentials that give whatever holds them legitimate-looking authority ^[11].

Exposure follows the scope of the tokens sitting on developer machines and CI runners. The worm enumerates the package list attached to the identity it steals, so the count of packages at risk equals the count that identity may publish to ^[17]. GitGuardian says the same sweep also looks for cloud, Kubernetes and Vault credentials ^[5].