A Supply-Chain Worm Wrote Itself Into Claude Code's Hook Files to Survive Credential Rotation

Rotating your credentials and removing a poisoned package is supposed to end an npm supply-chain...