ChainDrop Shai-Hulud 2.0 IDE Cross-Referencing Persistence Hook

Jeff Daisley@JDaisley

•updated Aug 4, 2026•1•0•9

Detects ChainDrop/Shai-Hulud 2.0 npm worm cross-referencing IDE persistence hooks: Claude Code SessionStart hooks invoking node .vscode/setup.mjs, VS Code folderOpen tasks invoking node .claude/setup.mjs, or payload dropper files referencing both sides of the chain.