CrowdStrike and Socket.dev Uncover SANDWORM_MODE: A Self-Propagating Worm Targeting AI Developer Toolchains

CrowdStrike and Socket.dev have uncovered SANDWORM_MODE, a self-propagating supply chain worm that targets AI developer toolchains, as detailed in research published by CrowdStrike on July 23, 2026. This multi-stage npm supply chain worm, first detected by Socket.dev in February 2026, represents the first documented case of a worm exploiting trust relationships in AI-augmented development pipelines.

How SANDWORM_MODE Operates

The SANDWORM_MODE worm initiates its spread through 19 malicious npm packages. Once integrated into a development environment, it systematically steals credentials, which are then leveraged to infect additional downstream repositories. This propagation occurs via various vectors, including npm publish commands, GitHub pull requests, and git hooks, demonstrating a multi-faceted approach to expanding its reach.

Exploiting AI Coding Assistants

A critical aspect of SANDWORM_MODE's functionality involves deploying rogue Model Context Protocol (MCP) servers. These malicious servers are then injected into the configuration files of popular AI coding assistants such as Claude Desktop, Cursor, VSCode, and Windsurf. By manipulating these configurations, the worm tricks the AI assistants into silently exfiltrating sensitive data, including SSH keys, AWS credentials, and API tokens, without the developer's knowledge.

Detection Challenges and Stealth Mechanisms

Detecting SANDWORM_MODE presents significant challenges due to its advanced stealth mechanisms. The worm's payloads unpack directly into memory via /dev/shm and are immediately unlinked, leaving no persistent on-disk forensic artifacts. Furthermore, the worm incorporates a 48- to 96-hour time-delay trigger on developer machines, which complicates cause-and-effect analysis and hinders immediate detection. In contrast, CI environments are targeted and attacked without this delay.

Implications for AI-Augmented Development

This incident marks the first documented instance of a worm specifically exploiting the inherent trust relationships within AI-augmented development pipelines. The ability of SANDWORM_MODE to compromise tools like Claude Desktop, Cursor, VSCode, and Windsurf underscores a growing vulnerability in the software supply chain, particularly as more developers integrate AI coding assistants into their workflows. While CrowdStrike has not yet attributed the campaign to a specific threat actor, the tactics align with those observed from known software supply chain attack groups.

Conclusion

The discovery of SANDWORM_MODE by CrowdStrike and Socket.dev serves as a critical warning for developers and organizations relying on AI-augmented development tools. The worm's sophisticated propagation methods, credential theft capabilities, and stealthy exfiltration of sensitive data highlight the evolving landscape of software supply chain attacks. Vigilance in monitoring npm packages, securing development environments, and scrutinizing configurations for AI coding assistants will be essential in mitigating such advanced threats.

Sources

• GitHub - otaviomarcal/npm-supply-chain-detector: A simple project to detect the npm supply chain attack · GitHub
• SANDWORM_MODE-Sha1-Hulud-Style-npm-Worm/SANDWORM_MODE_CAMPAIGN_REPORT.md at main · Security-Phoenix-demo/SANDWORM_MODE-Sha1-Hulud-Style-npm-Worm · GitHub
• openclaw-security-monitor/SKILL.md at main · adibirzu/openclaw-security-monitor · GitHub
• GitHub - adibirzu/openclaw-security-monitor: Proactive security monitoring for OpenClaw deployments. Detects ClawHavoc, AMOS stealer, CVE-2026-25253, memory poisoning, and supply chain attacks. · GitHub
• alexgreensh/repo-forensics: Offline security scanner for AI-...