ChainDrop/Shai-Hulud npm Worm - Node Dropper Execution via VS Code or Claude Hook

Ethan Andrews@eandrews

•updated Aug 4, 2026•31•0•30

Detects the execution of malicious 'node.exe' processes that invoke 'setup.mjs' or 'math_init.js' scripts from within .vscode or .claude configuration directories. This pattern is characteristic of the ChainDrop/Shai-Hulud npm supply chain worm, which leverages VS Code tasks or Claude Code session hooks to achieve persistent execution of dropper scripts without triggering standard npm installation flows.