ChainDrop. The access path.
An npm worm grew its credential scan to 469 locations, AI tool configs included. Agent credentials are now a standard target in supply chain malware, not a novelty.
The record
Entry point. npm registry, malicious versions of widely used caching libraries.
The identity in the middle. AI coding tool provider API keys and MCP server definitions, harvested from developer and CI machines alongside cloud keys, GitHub tokens, SSH keys and Kubernetes configs.
What was reached. further packages, the worm republishes using harvested maintainer credentials.
An npm worm grew its credential scan to 469 locations, AI tool configs included.
The path, step by step.
Taken from the published reporting. Nothing here is reconstructed.
| Step | Role in the path | What the reporting records |
|---|---|---|
| npm registry | Entry | malicious versions of widely used caching libraries |
| the dependency graph | Step | over 800 downstream packages affected |
| developer and CI machines | Step | 469 credential locations scanned, up from 189 |
| AI tool configuration files | Step | provider tokens and MCP server definitions taken |
| further packages | Reached | the worm republishes using harvested maintainer credentials |
Where a breakpoint would have been
Where provider keys and MCP definitions are stored. A long lived API key in a dotfile is reachable by anything that runs on the machine, and worms now look for it by name. Short lived, per project credentials remove the value of the file before it is found.
A breakpoint is the single change that closes a path with the least disruption. Read how that is chosen in the breakpoint page. The full narrative is in the teardown.
5 steps from entry to data.
Where this comes from.
Every field on this page is taken from the published reporting below. The breakpoint assessment is Elmoz reading that path, not a statement about what the affected organisation did.
Cyber Security Agency of Singapore, AD-2026-009 · Cloud Security Alliance Labs research note
Questions, answered.
The two questions this record answers.
What was the entry point in the ChainDrop incident?
The published path starts at npm registry, malicious versions of widely used caching libraries.
What did it reach?
The last step in the published path is further packages, the worm republishes using harvested maintainer credentials.
Other incidents.
Same database, different path shape.
See what your agents can reach. Before someone else does.
Book a demo and we walk through the access paths in an environment like yours.