SANDWORM_MODE: the npm worm targeting your AI coding tools
If you use Claude Desktop, Cursor, VS Code, or Windsurf in your dev workflow, CrowdStrike just published research you should read. The threat is a multi-stage npm supply chain worm called SANDWORM_MODE, and it is specifically designed to exploit the trust relationships inside AI-assisted development environments.
What SANDWORM_MODE Does
The attack starts when a compromised npm package is imported. An obfuscated loader fires, uses multiple layers of encoding and runtime unpacking to evade static analysis, then fingerprints the environment to tell the difference between a developer workstation and a CI runner.
From there, it harvests credentials: .npmrc tokens, environment variables containing keys, secrets, tokens, or passwords, and cryptocurrency wallet keys. It also collects API keys for nine AI model providers from environment variables and .env files.
️ The MCP Angle
The most relevant piece for operators using AI coding tools: SANDWORM_MODE deploys a rogue MCP server into a hidden directory, then inserts configuration entries into Claude Desktop, Cursor, VS Code, and Windsurf so that server appears to be a trusted tool provider.
Once in place, the rogue server instructs the AI assistant to read and exfiltrate SSH keys, AWS credentials, npm tokens, and environment secrets through the tool interface. It is “living off the AI toolchain,” as CrowdStrike puts it, borrowing a phrase from the long-established tactic of abusing legitimate system tools to hide malicious activity.
How It Spreads
With stolen credentials, SANDWORM_MODE can propagate across your entire development footprint:
- npm tokens: Identifies the publisher account, injects malicious code, and republishes infected package versions.
- GitHub API tokens: Enumerates accessible repos, injects a dependency, commits changes or opens a pull request, and adds a workflow that executes in the context of the base repository.
- SSH fallback: If API access is unavailable, clones repositories via SSH, alters them, and pushes changes directly.
- Git hooks: Writes malicious pre-commit and pre-push hooks into global Git templates so every new repo created or cloned on the compromised machine inherits the infected hooks.
On developer workstations it delays part of its activity by 48 to 96 hours. In CI environments it moves immediately, since those systems may exist only briefly. That timing gap puts the initial package import and the malicious actions in separate telemetry windows, complicating detection.
Detection Gaps
CrowdStrike investigated 14 behaviors linked to SANDWORM_MODE. Nine produced some detectable signal. Only two met the bar for customer-visible alerting. The company deployed 65% of the detection candidates it developed. The rest were ruled infeasible because the malicious actions looked too similar to normal developer and CI automation.
The destructive fallback routine, which wipes writable user files if both propagation and exfiltration fail, overlaps with legitimate secure deletion operations. The malware also targets password manager CLI tools and local SQLite stores, including Apple Notes, Messages, Joplin, and clipboard history, before sending data to attacker infrastructure. DNS tunnelling is used as a fallback if primary exfiltration channels are blocked.
“SANDWORM_MODE is not a one-off campaign as much as it is a proof of concept for an emerging attack class.” – CrowdStrike
The practical takeaway: every layer of an AI-driven CI/CD pipeline is both a dependency and a potential attack surface. If you manage npm packages or GitHub Actions in any capacity, auditing your MCP server configurations and reviewing which tools have access to your environment variables is worth doing now.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
