A self-labeled npm supply chain worm (February 2026) that published 19 low-suspicion packages alongside typosquats of developer tools such as Claude Code. Its payload propagates through the victim's npm publishing credentials, with a parallel opencraw package serving as a command channel.