In the wild
Realized harm
ChainDrop: npm supply-chain campaign that plants Claude Code SessionStart hooks and VS Code folderOpen tasks so opening the repo runs the payload
AIR-2026-0182 AIR record · 2026-08-chaindrop-agent-hook-campaign
A real party was affected. This incident caused actual consequences, not a demonstrated capability.
From the supporting source
The attackers added a Claude Code `SessionStart` hook and a VS Code `folderOpen` task that could launch the payload when the repository was opened.pillar.security
The record
Disclosed
2026-08-04
Vendor
multiple / open source
Product
@picsart/ai-sdk, @ornikar/eslint-config, jaredwray/keyv and other repos; Claude Code and VS Code as execution vehicles
Risk domain
Tool misuse › Supply chain vulnerabilities
Also touches
Credential theft
System type
Generative model
Who acted
Agent acted — SessionStart hooks make the agent run the payload on repo open
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
Compromised npm package and repository config
Impact type
Credential theft, Supply chain compromise
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI04 – Agentic Supply Chain Vulnerabilities
- MITRE ATLAS
- AML.T0040 – AI Supply Chain Compromise
- NIST AI RMF
- MAP 4.1
- EU AI Act
- Annex III §2
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool failure
- Mitigation
- Scan dependencies and container images for vulnerabilities; Use trusted sources.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
developers and CI runners cloning affected npm packages and repositories
Capability abused
Defense & remediation
Recorded defense
none for hook auto-execution
Guardrail kinds
None
Guardrail outcome
Not applicable
Fix shipped
ongoing investigation at publication
Taxonomy & references
Curator notes
Pillar Security analysis (2026-08-04) of a campaign first reported by StepSecurity, with SafeDep, Snyk and Socket also covering it. Self-propagating via stolen credentials; scrapes GitHub Actions runner process memory. Sibling of the Hades campaign (2026-06-hades-agent-config-hook-campaign) - both weaponize agent lifecycle hooks as the execution primitive, which is the durable lesson.
Supporting sources
Cite as
Enkrypt AI. "ChainDrop: npm supply-chain campaign that plants Claude Code SessionStart hooks and VS Code folderOpen tasks so opening the repo runs the payload". AIR, AIR-2026-0182. https://agentincident.vercel.app/i/AIR-2026-0182/ (accessed 2026-10-19).