Active npm Supply Chain Attack Backdoors Claude Code and VS Code Configs

A two-wave malware campaign compromised 89 npm packages totaling over 760,000 monthly downloads, injecting persistent code into Claude Code startup settings and VS Code project configs that survives package removal, silently exfiltrates credentials, and can wipe the home directory if tokens are revoked before the malware is cleaned. Some malicious versions remain live on the npm registry.