SANDWORM_MODE is a sophisticated multi-stage npm supply chain worm that exploits the runtime behaviors of AI coding assistants, CI automation, and LLM toolchains. The worm uses multi-layer encoding to bypass static analysis, performs environment fingerprinting to differentiate developer workstations from CI runners, and deploys a rogue MCP server to compromise AI assistants into exfiltrating credentials. With propagation via stolen npm tokens, GitHub API tokens, and SSH fallback, plus a destructive dead switch, the campaign demonstrates a new class of supply chain attacks targeting the modern AI-driven development pipeline.
MCP Server
2 posts
Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacks Varonis Discovers Local File Inclusion in AWS Remote MCP Server via CLI Shorthand Syntax Varonis Threat Labs identified a Local File Inclusion (LFI) vulnerability (CVE-2026-4270) in the AWS Remote MCP Server that allows authenticated users to read arbitrary files. By exploiting the AWS CLI shorthand file-loading syntax via the aws___call_aws tool, attackers can bypass access restrictions and extract sensitive file contents through error messages.
