ChainDrop: When Opening a Repository Becomes Execution

**ChainDrop** is an active software supply‑chain campaign that embeds executable repository and editor/agent lifecycle hooks (Claude Code SessionStart, VS Code folderOpen, and npm preinstall) to launch a loader that downloads Bun and runs an obfuscated JavaScript payload which harvests developer, cloud, and CI/CD credentials, attempts memory scraping of GitHub Actions runners, installs persistence, and propagates by compromising additional packages and repositories; the report includes hashes, hook samples, persistence paths, detection opportunities, and recommends agentic pre‑execution controls in addition to EDR.