The Sandworm_Mode Campaign & the Evolution of Wormable NPM Attacks

In late February 2026, a sophisticated self-propagating worm tracked as SANDWORM_MODE was discovered within the npm registry. Unlike traditional info-stealers that passively collect environment variables, this campaign is the first documented instance of a cross-modal supply chain worm specifically designed to subvert AI Coding Assistants and Model Context Protocol (MCP) servers. By exploiting the "inherited trust" developers place in their AI-assisted IDEs, the attackers have moved beyond simple typosquatting into a new era of Agentic Lateral Movement.

1. The Anatomy of the Event: "Typo to Takeover"

The campaign was initiated through 19 malicious npm packages published under the aliases official334 and javaorg. These packages were meticulously designed to target the modern developer's stack, specifically mimicking high-velocity AI utilities and system colors. T1195.002

Targeted Packages (Partial List)

The "Silent" Execution

The malware utilizes a two-stage loader. Unlike older attacks that relied on postinstall scripts (which are increasingly flagged by modern security tools), SANDWORM_MODE executes directly upon import. When a developer—or an AI agent—runs import "suport-color", the Stage 1 loader initiates. It performs a "Quick Harvest" of environment tokens (npm, GitHub, AWS) and initiates a 48-hour time gate to evade automated sandbox analysis. T1204.002

2. Technical Deep Dive: The AI Weaponization Path

3. The "Worm" Logic: Exponential Propagation

SANDWORM_MODE is not just a thief; it is a replicator. Using the tokens harvested in Phase A, it attempts to "worm" its way through the ecosystem:

4. The "Dependency Confusion" Gap in the AI Era

Why did this work? We identify three core vulnerabilities in the modern developer workflow:

I. The "AI Hallucination" Vector

AI coding assistants are prone to hallucination. If a developer asks for a library to "handle terminal colors in Claude," the AI might hallucinate claud-code instead of the official tool. Attackers are now proactively "pre-registering" these hallucinated names.

II. The "Vibe Coding" Security Debt

The rise of "Vibe Coding"—where developers focus on high-level logic and trust the AI to handle the "boring" parts (like importing dependencies)—has created a massive oversight gap. Developers rarely audit the sub-dependencies pulled in by an AI agent.

III. Flat Namespace Risks

Current MCP implementations often lack a "Permission Boundary" between servers. Once an MCP server is registered, it has equal access to the LLM's context as any other server. SANDWORM_MODE exploits this lack of isolation to "listen in" on and manipulate conversations.

5. Mitigation & Defensive Strategy

To defend against SANDWORM_MODE and its successors, organizations must move beyond static scanning:

• Audit MCP Configurations: Regularly inspect claude_desktop_config.json and similar files for unauthorized servers.
• Enforce OIDC for CI/CD: Move away from long-lived npm/GitHub tokens. Use OpenID Connect (OIDC) to grant short-lived, scoped access.
• Use npm install --ignore-scripts: While this doesn't stop import-time execution, it limits the initial footprint of most npm-based worms.
• Human-in-the-Loop for MCP: Configure AI assistants to require manual "Approval" for every tool call, especially those involving file system reads or network egress.

6. Actionable Next Steps

For Developers & Individual Contributors

• Audit AI Configs: Manually inspect your AI Assistant configuration files. Look for any entries pointing to local scripts in ~/.dev-utils or hidden folders.
• Verify Imports: Avoid copy-pasting code from AI outputs without verifying package names. If an AI suggests a package like claud-code, double-check the spelling against official documentation.
• Rotate Secrets: If you have installed any suspicious npm packages in the last 60 days, rotate your GitHub PATs, AWS Access Keys, and npm tokens immediately.
• Enable 2FA: Ensure 2FA is mandatory for your npm and GitHub accounts to prevent the "Package Takeover" phase of the worm.

For Security Operations (SecOps)

• Block Malicious IOCs: Add the C2 domains and npm aliases (official334, javaorg) to your EDR and network blocklists.
• Scan for MCP Persistence: Deploy a fleet-wide query (via OSQuery or similar) to detect unauthorized modifications to AI assistant configuration files across developer workstations.
• Monitor GitHub Actions: Implement a policy to restrict GitHub Actions to "Verified Creators" or specific internal runners to prevent the quality.yml injection vector.
• Secret Scanning: Enable enhanced secret scanning on all repositories to detect if stolen tokens are being used to push malicious commits.

For Engineering Leadership & Product Teams

• Implement OIDC: Transition all CI/CD pipelines to use OpenID Connect (OIDC) for cloud provider authentication, eliminating the need for long-lived secrets.
• Enforce Scoped Access: Ensure that developer tokens are scoped to specific repositories rather than "All Repositories" to limit the lateral movement radius.
• Develop MCP Guardrails: Implement a "Gatekeeper" service that audits tool calls before they are sent to the LLM, specifically looking for attempts to access sensitive system paths (e.g., ~/.ssh).

7. Indicators of Compromise

Malicious npm Packages (19 Total)

Behavioral Indicators

8. Mjolnir Security: Defending Against Agentic Attacks

The Sandworm_Mode campaign represents a shift toward "Agentic" supply chain attacks—malware that doesn't just steal data, but actively manipulates AI assistants and CI/CD pipelines to propagate. Mjolnir Security provides a multi-layered defense architecture.

Guarding the CI/CD Pipeline

• Workflow Integrity Monitoring: Mjolnir's Sentinel Engine monitors your .github/ directory in real-time. Any addition of unapproved YAML files triggers an immediate block.
• Automated PR Guardrails: Automatically flags Pull Requests that include version bumps in package.json for packages with low "Trust Scores."
• OIDC Enforcement: Facilitates the transition from long-lived secrets to OpenID Connect (OIDC).

Securing the AI Assistant (MCP Defense)

• MCP Configuration Hardening: Mjolnir's Endpoint Agent periodically audits AI assistant configuration files, identifying and removing unauthorized tool registrations pointing to hidden or suspicious local directories.
• Prompt Injection Firewall: Our AI-Proxy Layer scans outgoing "Sampling" requests from MCP servers for malicious instructions and redacts sensitive file contents before they leave the local environment.
• Agentic Visibility: A centralized dashboard showing every tool call made by AI assistants across your engineering org.

Supply Chain "Deep Scan"

• Behavioral Sandbox Analysis: Mjolnir runs suspicious packages in a high-fidelity sandbox that simulates a developer's environment to lure out "Time-Gated" exfiltration logic.
• Dependency Tree Pruning: Automatically identifies "Hallucinated" or typosquatted packages within your node_modules and provides one-click remediation.
• Registry Proxying: Acts as a secure upstream for your npm registry, automatically blocking the 19 known SANDWORM_MODE packages.