ChainDrop/Mini Shai-Hulud npm Worm IDE Persistence Hook

Jeff Daisley@JDaisley

•updated Aug 4, 2026•2•0•5

Detects malicious persistence hooks in IDE configuration files (.claude/settings.json, .vscode/tasks.json) used by the ChainDrop or Mini Shai-Hulud npm worm to execute unauthorized JavaScript payloads upon opening a repository.