Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacks

A sophisticated multi-stage npm supply chain worm called SANDWORM_MODE was discovered in early 2026, targeting AI-augmented development environments like GitHub Copilot and Cursor. The worm exploits integrations between AI coding assistants and CI/CD pipelines to harvest credentials, propagate through package registries, and establish persistence. Detection efforts focus on identifying anomalous Node.js process behaviors and ancestry.

SANDWORM MODE represents a sophisticated multi-stage npm supply chain worm discovered in early 2026. Unlike traditional attacks, it specifically targets modern AI-augmented development environments, including tools like GitHub Copilot and Cursor. By exploiting the integration between AI coding assistants and CI/CD pipelines, the worm successfully harvests credentials, propagates through package registries, and establishes persistence within developer environments. The infection chain operates in three distinct stages, starting with an obfuscated loader that bypasses static analysis. After performing initial reconnaissance and harvesting sensitive data like cryptocurrency keys and npm tokens, the worm deploys its full capability suite. This includes the registration of rogue MCP servers to compromise AI assistants and a destructive 'dead switch' that shreds user files if exfiltration fails. Detection engineering efforts focus on identifying anomalous Node.js process behaviors and ancestry.