I Built a Tool That Blocks the npm Worm Before It Runs

Description:
npm supply-chain malware just got a self-spreading worm — ChainDrop — and it's built to steal the AI-coding keys (.claude, .cursor, .anthropic) sitting in your home folder. In this build I show you a ~50-line Node detector that flags known-bad packages and hidden install scripts BEFORE npm install runs — plus the two-line .npmrc that makes the worm's main weapon inert. No dependencies, no paid service.

What you'll build & learn:
• How the ChainDrop / Shai-Hulud worm actually self-replicates (steal token → pull the maintainer's other packages → inject → bump the patch version → republish)
• Why a hidden "preinstall" script runs with your full user permissions before your code ever loads
• A ~50-line detector: package-lock.json → OSV.dev /v1/querybatch (free, no API key) → red/green report
• The catch OSV can't make at hour zero — scanning each manifest for preinstall/install/postinstall
• The two-line .npmrc: ignore-scripts=true + a release-age cooldown, and WHY each neuters the worm
• npm audit signatures + npm 11.16 → v12 (install scripts becoming opt-in)
• The honest limits: why provenance/SLSA would NOT have stopped this, and why ignore-scripts isn't a force field

Mental model: you don't install code — you execute a stranger's code, automatically, the instant you install.

⚠️ AUTHORIZED / DEFENSIVE security content. This is a defensive build — detect and block before install. No offensive payload is demonstrated.

Sources: StepSecurity + Microsoft Security (ChainDrop forensic reports, Aug 2026), OSV.dev, npm CLI v12 changelog. Package counts vary across outlets; StepSecurity's forensic count (444 packages / 2,212 versions) is used on screen.

CHAPTERS:
00:00 The worm that rewrites packages
00:16 Aug 4: the plumbing turned hostile
00:57 It hunts your AI-coding keys
01:27 How one token becomes a chain reaction
02:39 Shai-Hulud → ChainDrop
03:22 Let's build the guard
03:39 Detector: lockfile → OSV
04:17 The catch OSV can't make
04:56 .npmrc: two lines make it inert
05:42 Lock it down (+ honest myths)
06:29 Your 10-minute checklist


Support: https://www.patreon.com/cybercreed
UPI : cybercreed@ibl
Social Media:

Discord:https://discordapp.com/invite/Y57rAcz
Linkedin: https://www.linkedin.com/in/aditya-p-s/
Github: http://github.com/CreatorGhost/
Telegram: https://t.me/cybercreed
Insta: https://www.instagram.com/cyber.creed/