Microsoft's ChainDrop analysis traces a self-propagating npm compromise across more than 400 packages. A malicious preinstall hook ran before installation completed, harvested npm, GitHub, cloud, Kubernetes, and Vault credentials, then used recovered release authority to modify and republish additional packages. Stolen GitHub access also injected Claude and VS Code configuration files as a secondary persistence path.
The attack chain is about identity multiplication. One compromised maintainer token can become package writes, workflow access, cloud enumeration, secret-store reads, and releases with legitimate-looking provenance. Rotating a single token is not enough when build runners, caches, OIDC trust, and downstream artifacts may already be contaminated.
IBM's agent identity framing provides the organizational counterpart: unique agent identities, delegated user intent, just-in-time task-scoped credentials, runtime authorization at every tool call, instant revocation, and signed audit trails. Applied to coding agents, the release credential should appear only at the egress boundary, never inside the model context or general-purpose sandbox.