13 minhigh
Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacks
SANDWORM_MODE is a sophisticated multi-stage npm supply chain worm that exploits the runtime behaviors of AI coding assistants, CI automation, and LLM toolchains. The worm uses multi-layer encoding to bypass static analysis, performs environment fingerprinting to differentiate developer workstations from CI runners, and deploys a rogue MCP server to compromise AI assistants into exfiltrating credentials. With propagation via stolen npm tokens, GitHub API tokens, and SSH fallback, plus a destructive dead switch, the campaign demonstrates a new class of supply chain attacks targeting the modern AI-driven development pipeline.
Sens:▲ 24h
Showing defanged values
- filename.dev-utils/server.jsRogue MCP server deployed by SANDWORM_MODE to a hidden directory under the user's home folder, registered as a trusted tool provider in AI assistant configurations to exfiltrate credentials via the tool interface.
- filename.node-analyzer/Hidden directory created by SANDWORM_MODE for rogue MCP server deployment, generated from internal word pools as an alternate path to .dev-utils/.
Detection / Hunteropenrouter
What Happened
A new type of malicious software called SANDWORM_MODE has been discovered spreading through npm packages, which are software components that developers commonly use to build applications. When a developer or automated build system installs an infected package, the worm steals passwords, digital wallet keys, and other sensitive information, then spreads itself by publishing more infected packages and modifying code repositories. What makes this attack especially dangerous is that it specifically targets AI coding assistants (tools that help programmers write code) by installing a fake server that tricks the AI into handing over sensitive credentials. If the worm cannot spread or steal data, it destroys all of the user's files as a last resort. Organizations that use npm packages, AI coding tools, or automated build systems should review their software dependencies for suspicious packages, check for unauthorized changes to development tool configurations, and ensure sensitive credentials are stored securely rather than in plain text files or environment variables.
Key Takeaways
- SANDWORM_MODE is a multi-stage npm supply chain worm targeting AI-augmented development workflows, including AI coding assistants and LLM toolchains, across 19 malicious packages from two publisher aliases.
- The worm uses a dual-path time gate: 48-96 hour delay on developer workstations but immediate execution in CI environments, maximizing coverage across both persistent and ephemeral targets.
- Persistence is achieved via malicious git template hooks in ~/.git-templates/hooks/ with global init.templateDir modification, infecting all future git operations on the compromised system.
- A rogue MCP server is deployed to hidden directories and registered in AI assistant configs (Claude Desktop, Cursor, VSCode, Windsurf), tricking AI tools into exfiltrating credentials via the tool interface.
- A destructive dead switch shreds all writable user files if both propagation and exfiltration fail, causing data destruction as a contingency.
Affected Systems
- npm package registry
- Node.js runtime environments
- CI/CD runners (GitHub Actions, GitLab CI, Bitbucket Pipelines)
- AI coding assistants (GitHub Copilot, Cursor, Claude Code, Windsurf)
- Developer workstations (macOS, Linux)
- GitHub repositories
- LLM provider APIs (OpenAI, Anthropic, Google, Groq, Together, Fireworks, Replicate, Mistral, Cohere)
Vulnerabilities (CVEs)
None identified.
Attack Chain
- Initial Access: Malicious npm packages with multi-layer encoded loader (Base64, zlib, XOR) imported by developer or CI runner, triggering eval() or Module._compile() on package import
- Execution & Reconnaissance: Payload decodes at runtime; environment fingerprinting determines dev vs CI context; .npmrc tokens, environment variables (KEY, SECRET, TOKEN, PASSWORD patterns), and cryptocurrency wallet keys are extracted and crypto keys immediately exfiltrated to Cloudflare Worker endpoint
- Persistence: Malicious pre-commit and pre-push hooks written to ~/.git-templates/hooks/ with git config --global init.templateDir set to ensure all future git operations inherit infected hooks
- Propagation: Stolen npm tokens used to enumerate and publish infected packages; GitHub API tokens used to inject carrier dependencies and pull_request_target workflows; SSH fallback clones and pushes to target repos
- AI Toolchain Compromise: Rogue MCP server deployed to hidden directory (~/.dev-utils/server.js), registered in Claude Desktop, Cursor, VSCode, and Windsurf configs; AI assistants instructed to exfiltrate SSH keys, AWS credentials, npm tokens, and env secrets via tool interface; LLM provider API keys harvested from env vars and .env files
- Exfiltration & Impact: Multi-channel exfiltration via HTTPS to attacker infrastructure, mirrored to GitHub private repos, with DNS tunneling (Base32/DGA) as fallback; destructive dead switch shreds all writable user files if propagation and exfiltration both fail
Detection Availability
- YARA Rules: No
- Sigma Rules: No
- Snort/Suricata Rules: No
- KQL Queries: No
- Splunk SPL Queries: No
- EQL Queries: No
- Other Detection Logic: Yes
- Platforms: CrowdStrike Falcon platform detections
CrowdStrike developed detection indicators based on process tree ancestry combined with narrowly scoped target path specificity. 65% of detection candidates were deployed to production; the remainder were infeasible due to telemetry constraints. Detections are described as protecting CrowdStrike customers and a screenshot of one triggering detection is referenced in the article.
Detection Engineering Assessment
copy:
| Dimension | Rating | Rationale |
|---|---|---|
| EDR Visibility | Medium | The article notes that successful detections relied on process tree ancestry (Node.js parent process) combined with target path specificity. However, 35% of detection candidates were infeasible due to telemetry constraints, and the attack's use of /dev/shm for reflective loading with immediate file unlinking leaves no on-disk forensic artifacts. The multi-layer encoding bypasses static analysis at publish time. |
| Network Visibility | Medium | The worm uses multi-channel exfiltration including HTTPS POST to Cloudflare Worker endpoints, GitHub API calls, and DNS tunneling with Base32 encoding and DGA fallback. HTTPS exfiltration blends with legitimate traffic, and DNS tunneling as a last-resort channel may evade standard network monitoring. The initial crypto key exfiltration occurs before delayed logic activates, narrowing the network detection window. |
| Detection Difficulty | Hard | The article explicitly states that 'the environments where malicious actions are taking place are functionally indistinguishable from legitimate operations.' 35% of detection candidates were infeasible due to telemetry constraints. The worm's dual-path design (delayed on dev, immediate on CI), multi-layer encoding, reflective loading into /dev/shm with immediate unlinking, and abuse of legitimate tools (npm, git, ssh, GitHub API) all contribute to detection difficulty. |
Required Log Sources
- Process execution logs with parent-child process tree (EDR)
- File system modification logs for home directory paths
- Network flow logs with TLS metadata
- DNS query logs for tunneling detection
- npm publish and package registry audit logs
- GitHub audit logs for pull_request_target workflow triggers
- Git configuration change logs
- Environment variable access monitoring
Hunting Hypotheses
copy:
| Hypothesis | Telemetry | ATT&CK Stage | FP Risk |
|---|---|---|---|
| Consider hunting for Node.js processes creating files in hidden directories under the user's home folder (e.g., directories starting with a dot that are not standard config directories), as this may indicate rogue MCP server deployment by SANDWORM_MODE or similar supply chain worms. | EDR file creation events with process ancestry, filtered for Node.js parent processes writing to atypical hidden paths in the home directory. | Persistence / AI Toolchain Compromise | Medium - legitimate development tools may create hidden directories for configuration or caching purposes. Narrowing to specific observed patterns (.dev-utils, .node-analyzer) reduces false positives but may miss variants. |
| Consider hunting for processes executing git config --global init.templateDir modifications, especially when initiated by a Node.js parent process, as this is the persistence mechanism used by SANDWORM_MODE to infect all future git operations. | EDR process execution logs with command-line arguments, focusing on git config commands with global scope and init.templateDir target. | Persistence | Low - modifying global git template directory is uncommon in normal development workflows and is a strong behavioral indicator of malicious persistence. |
| Consider hunting for Node.js processes that write files to /dev/shm and immediately delete or unlink them, as this reflective loading pattern is used by SANDWORM_MODE to execute Stage 2 payloads without leaving on-disk forensic artifacts. | EDR file system events for /dev/shm with process ancestry, correlated with file deletion events within a short time window. | Execution | Low to Medium - while /dev/shm is used by some legitimate applications for temporary files, the pattern of write-then-immediate-delete by a Node.js process is suspicious and uncommon. |
| Consider hunting for Node.js processes spawning SSH commands to github.com or executing npm publish/whoami commands, as these indicate the propagation phase where stolen credentials are used to spread infected packages or clone target repositories. | EDR process execution logs with parent-child relationships, filtering for Node.js parent processes with ssh or npm child processes. | Propagation | Medium - CI/CD runners and development scripts may legitimately execute npm publish or ssh to GitHub. Correlating with other indicators (e.g., recent package import, environment variable access patterns) improves signal quality. |
| Consider hunting for find and shred command combinations targeting the user's home directory, as this is the destructive dead switch activated when both propagation and exfiltration fail in SANDWORM_MODE infections. | EDR process execution logs with command-line arguments, filtering for find commands with -writable flag piped to shred. | Impact | Low - the specific combination of find with -writable and shred targeting the home directory is highly indicative of malicious data destruction and has virtually no legitimate use case. |
Control Gaps
- Static analysis of npm packages at publish time is bypassed by multi-layer encoding (Base64, zlib, XOR) with indirect eval() or Module._compile() calls that defer malicious logic to runtime.
- Fork-based isolation in GitHub is bypassed by injecting pull_request_target workflows that execute in the context of the base repository with elevated permissions.
- Traditional file-based forensics is limited by Stage 2 reflective loading into /dev/shm with immediate file unlinking, leaving no on-disk artifacts.
- Network-based exfiltration detection is challenged by multi-channel approach: HTTPS to Cloudflare Workers blends with legitimate traffic, GitHub repo mirroring uses authenticated API calls, and DNS tunneling with DGA fallback evades static domain blocklists.
- Time-delayed execution (48-96 hours) on developer machines may exceed typical sandbox analysis windows, allowing the worm to evade dynamic analysis environments.
- CI environment detection bypasses time-delay gates entirely, making compromise of ephemeral CI runners harder to catch as artifacts are destroyed when the runner terminates.
- 35% of detection candidates were infeasible due to current telemetry constraints, indicating significant gaps in visibility for AI toolchain and Node.js runtime behaviors.
Key Behavioral Indicators
- Node.js parent process creating files in hidden home directory paths (.dev-utils/, .node-analyzer/)
- Node.js process executing git config --global init.templateDir modifications
- Node.js process writing to /dev/shm followed by immediate file deletion/unlinking
- Node.js process spawning ssh commands to github.com or executing npm publish/whoami
- Process tree showing Node.js parent with find/shred child processes targeting home directory
- Node.js process accessing multiple environment variables matching KEY, SECRET, TOKEN, or PASSWORD patterns in sequence
- Node.js process making HTTPS POST requests to endpoints shortly after package import (indicating quick harvest exfiltration)
- Modifications to AI assistant configuration files (Claude Desktop, Cursor, VSCode, Windsurf) registering new MCP server entries
False Positive Assessment
Medium - The article explicitly states that the environments where malicious actions are taking place are functionally indistinguishable from legitimate operations, and 35% of detection candidates were infeasible due to telemetry constraints. However, the detections that achieved production fidelity used process tree ancestry combined with narrowly scoped target specificity, which provides reasonable signal-to-noise separation. The main false positive risk comes from legitimate CI/CD operations that execute npm publish, git config, or ssh to GitHub from Node.js processes.
Recommendations
Immediate Mitigation
defender takeaway
- Verify against your organization's incident response runbook and team escalation paths before acting. Consider reviewing npm dependencies for any packages published by unknown or recently created publisher accounts, especially those installed since February 2026.
- Consider checking developer workstations and CI runners for the presence of hidden directories like ~/.dev-utils/ or ~/.node-analyzer/ which may indicate rogue MCP server deployment by SANDWORM_MODE.
- If your organization uses AI coding assistants (Copilot, Cursor, Claude Code, Windsurf), consider auditing their configuration files for unauthorized MCP server entries or newly registered tool providers.
- Consider rotating npm tokens, GitHub API tokens, and LLM provider API keys if any suspicious activity is detected in CI/CD pipelines or developer environments.
- If your EDR supports host isolation, consider isolating any systems where rogue MCP servers or malicious git template hooks are discovered to prevent further propagation.
Infrastructure Hardening
- Consider implementing npm package allowlisting or provenance verification (e.g., npm provenance statements) to prevent installation of untrusted packages in CI/CD pipelines.
- Evaluate whether GitHub Actions workflows using pull_request_target triggers can be restricted or require additional review, as these execute with elevated repository permissions and are abused by SANDWORM_MODE for propagation.
- If supported by your CI/CD platform, consider implementing secret scanning for .npmrc files, .env files, and environment variables to detect credential exposure before they can be harvested.
- Consider monitoring for DNS tunneling patterns and Base32-encoded DNS queries as a potential exfiltration channel, especially from CI/CD runner networks.
- Where supported by your tooling, consider implementing network egress restrictions for CI/CD runners to limit exfiltration paths to known-good endpoints.
User Protection
- Consider deploying EDR detection content that monitors for Node.js processes modifying git configuration or creating files in hidden home directory paths, as these are key behavioral indicators of SANDWORM_MODE.
- If your EDR supports it, consider alerting on Node.js processes that write to /dev/shm and immediately delete the file, as this indicates reflective loading behavior used in Stage 2.
- Consider implementing network monitoring for HTTPS POST requests from Node.js processes to Cloudflare Worker endpoints, especially shortly after package installation.
- If applicable to your environment, consider restricting which MCP servers can be registered in AI coding assistant configurations, or implement a review process for new tool provider registrations.
Security Awareness
- Consider incorporating supply chain attack awareness into existing developer training programs, emphasizing the risks of installing unverified npm packages and the potential for AI toolchain compromise.
- If applicable to your organization, consider educating developers on the risks of AI coding assistant configuration changes and how to verify trusted MCP server registrations.
- Consider reviewing and updating CI/CD pipeline security guidelines to address the threat of malicious npm packages targeting AI-augmented workflows, including guidance on reviewing package publishers and dependencies.
- Where relevant, consider raising awareness among developers about the risk of storing credentials in .npmrc files, .env files, and environment variables in development environments.
MITRE ATT&CK Mapping
MITRE ATT&CK Mapping13 techniques
Tactic
Initial Access
Tactic
Execution
Tactic
Persistence
Tactic
Stealth
Tactic
Credential Access
Tactic
Discovery
Tactic
Command and Control
Tactic
Exfiltration
Tactic
Impact
Additional IOCs
- File Paths:
~/.git-templates/hooks/- Directory where SANDWORM_MODE writes malicious pre-commit and pre-push hooks for persistence across all future git operations on the compromised system.~/.dev-utils/server.js- Full path of rogue MCP server deployed by the worm to a hidden directory under the user's home folder.
- Command Lines:
- Purpose: Persistence via git template directory modification to ensure all future git init/clone operations inherit malicious hooks | Tools:
git| Stage: Persistence |git config --global init.templateDir - Purpose: SSH-based propagation fallback to clone target repositories directly when API-based methods are unavailable | Tools:
ssh,git| Stage: Propagation |ssh -T [email protected] - Purpose: Destructive dead switch fallback that shreds all writable user files if both propagation and exfiltration fail | Tools:
find,xargs,shred| Stage: Impact |find ~ -type f -writable - Purpose: Publishing infected npm package versions to downstream consumers using stolen npm tokens | Tools:
npm| Stage: Propagation |npm publish
- Purpose: Persistence via git template directory modification to ensure all future git init/clone operations inherit malicious hooks | Tools:
