Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacks

1. Executive summary

CrowdStrike has published analysis of SANDWORM_MODE, a multi-stage npm supply chain worm first documented by Socket.dev in February 2026. The campaign distributed 19 malicious npm packages across two publisher aliases and exploited runtime behaviours of AI coding assistants, CI automation, and LLM toolchains to propagate and harvest credentials. The worm employs multi-layer obfuscation, time-delayed payload delivery, and fileless execution in /dev/shm to evade static and dynamic analysis. EMEA financial services organisations with development teams using npm packages, AI-augmented CI/CD pipelines (GitHub Copilot, Cursor, Claude Code, Windsurf), or ephemeral CI runners are directly exposed to credential theft, source-code compromise, and lateral propagation through their software supply chains. No CISA-KEV exploitation state or CVSS score has been resolved for this item; the underlying vulnerability class is supply-chain dependency confusion/runtime injection rather than a single CVE.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. While supply chain compromise and ICT incident management are broadly relevant, the trigger facts here — malicious npm packages targeting developer workstations and CI runners — do not distinctively engage a specific article beyond what would be true of any security incident involving a third-party software dependency. Organisations should still assess internally whether DORA Art. 28 (ICT third-party risk — general principles) or NIS2 Art. 21(2)(d) (supply chain security measures) apply based on whether the affected packages are integrated into regulated ICT services, but the advisory itself does not provide sufficient specificity to make that determination for all clients.

3. Technical analysis & attack chain

Attribution caveat: No named threat actor with a MITRE profile is identified in the source material. The campaign is attributed to two npm publisher aliases; no further actor attribution is provided. Treat all attribution as unconfirmed.

Source caveat: This advisory is based on a single vendor report (CrowdStrike) referencing original research by Socket.dev. Key technical claims are single-sourced; verify before enforcement.

Attack chain

Stage 0 — Obfuscated loader (initial access via package import)

1. Victim installs one of 19 malicious npm packages published under two publisher aliases.
2. On package import, the loader executes multi-layer decoding: Base64 decode → zlib inflate → XOR decryption → indirect eval() or Module._compile() calls.
3. The Stage 0 payload contains no distinctly malicious logic — its sole function is to unpack the next stage at runtime. This bypasses static analysis tools that scan package contents at publish time.

Stage 1 — Reconnaissance and quick harvest

4. The loader fingerprints the runtime environment to determine whether it is executing on a developer workstation or a CI runner.
5. CI environments bypass the time-delay gate entirely; developer workstations are subject to a 48–96 hour time bomb before Stage 2 activates.
6. The loader extracts: - .npmrc authentication tokens - Environment variables matching patterns: KEY, SECRET, TOKEN, PASSWORD - Cryptocurrency wallet keys
7. Harvested cryptocurrency keys are immediately exfiltrated via HTTP POST to an attacker-controlled Cloudflare Worker endpoint, before any delayed logic activates.

Stage 2 — Full capability suite (post-gate)

8. After the time-delay gate clears (or immediately in CI), AES-256-GCM decryption unpacks the full payload into /dev/shm.
9. The payload is executed via require(), then the file is immediately unlinked from disk — leaving no on-disk forensic artifacts (analogous to reflective loading adapted for Node.js).

Propagation vectors (three independent paths)

10. npm token propagation: Using stolen npm tokens, the worm calls whoami to identify the compromised identity, enumerates all packages published under that account, injects the Stage 0 loader shim into each, and runs npm publish to distribute infected versions to downstream consumers.
11. Source control propagation: The source material indicates SANDWORM_MODE targets source control credentials as part of its propagation, exploiting a different credential type from the npm token vector. (Specific technical detail on this vector is truncated in the source; treat as partial.)
12. Additional credential-type propagation: A third propagation vector exploiting a different credential type is referenced but not fully detailed in the available source material.

AI pipeline targeting: The Stage 2 capabilities map directly to six components of a modern AI CI/CD pipeline. The source identifies the pipeline components as including package registry, source control, AI coding assistants (GitHub Copilot, Cursor, Claude Code, Windsurf), CI automation (GitHub Actions, GitLab CI, Bitbucket Pipelines), and LLM toolchains. The environments where malicious actions occur are functionally indistinguishable from legitimate operations — a core detection challenge.

4. Mitigation & containment

P1 — Within 24 hours

• Audit npm dependency trees across all repositories and CI environments for the 19 malicious packages associated with SANDWORM_MODE. Cross-reference against Socket.dev's February 2026 research for the full package list. (The specific package names are not enumerated in the provided source material — obtain them directly from Socket.dev's original disclosure.)
• Rotate all npm access tokens (npm token create), especially any tokens stored in .npmrc files on developer workstations or CI runner environment variables. Revoke and reissue rather than refreshing.
• Rotate all CI/CD secrets matching environment variable patterns KEY, SECRET, TOKEN, PASSWORD that may have been exposed on affected runners.
• Block egress to unknown Cloudflare Worker endpoints from CI runners and developer workstations where feasible; the attacker-controlled endpoint domain is not specified in the source material, so apply blanket egress controls to Cloudflare Workers domains for CI environments unless explicitly allowlisted.
• Search /dev/shm on all Linux-based CI runners and developer workstations for recently created or unlinked files; monitor for require() calls targeting /dev/shm paths.

P2 — Within 72 hours

• Review npm publish logs for all organisational packages for unauthorised npm publish events or whoami API calls since February 2026.
• Audit Git history and source control access logs for anomalous commits or credential usage traceable to the propagation vectors.
• Implement npm package allowlisting (e.g., npm config set ignore-scripts true globally; use npm install --ignore-scripts in CI) to prevent runtime execution of postinstall scripts — the Stage 0 loader triggers on package import.
• Deploy runtime detection for Node.js processes invoking Module._compile() or indirect eval() with Base64/zlib/XOR-encoded input. These are the loader's execution primitives.
• Review CI runner ephemerality configuration: the worm's CI bypass of the time-delay gate means any CI runner that imported an affected package was fully exploited within a single pipeline run.

P3 — Within 7 days

• Implement npm provenance and signature verification (Sigstore/npm provenance) for all first-party and critical third-party packages.
• Deploy file integrity monitoring on /dev/shm across all Linux CI runners.
• Review and restrict npm token scopes: tokens should be scoped to specific packages and use CI-specific, short-lived tokens rather than long-lived automation tokens stored in .npmrc.
• Evaluate AI coding assistant configurations (Copilot, Cursor, Claude Code, Windsurf) for whether they execute untrusted package code during suggestion generation or code completion — this is an attack surface the worm specifically targets.

5. Indicators of compromise

No atomic indicators of compromise (domains, IPs, hashes, package names) are available in the provided source material. The source references 19 malicious packages and an attacker-controlled Cloudflare Worker endpoint but does not enumerate them. Obtain the full IOC set from Socket.dev's original February 2026 research.

Behavioural indicators

6. Detection

rule SANDWORM_MODE_Stage0_Loader {
  meta:
    author = "Adverse Trace"
    date = "2026-07-22"
    reference = "https://www.crowdstrike.com/en-us/blog/denying-the-worm-sandworm-mode-and-ai-toolchain-supply-chain-attacks/"
    description = "Detects SANDWORM_MODE Stage 0 obfuscated loader patterns in npm package JavaScript"
  strings:
    $compile = "Module._compile" ascii
    $eval = "eval(" ascii
    $b64 = "Base64" ascii nocase
    $zlib = "zlib" ascii
    $xor = "xor" ascii nocase
    $inflate = "inflate" ascii
    $shm = "/dev/shm" ascii
    $npmrc = ".npmrc" ascii
    $aes = "aes-256-gcm" ascii nocase
    $whoami = "whoami" ascii
    $publish = "npm publish" ascii
    $flag = "SANDWORM_MODE" ascii
  condition:
    $flag or (3 of ($compile, $eval, $b64, $zlib, $xor, $inflate) and 2 of ($shm, $npmrc, $aes, $whoami, $publish))
}

title: SANDWORM_MODE Stage2 Fileless Execution in /dev/shm
id: 7a3c1f2e-8b4d-4a6e-9c5f-1d2e3f4a5b6c
status: experimental
description: Detects file creation in /dev/shm followed by require() execution and immediate unlink, consistent with SANDWORM_MODE Stage 2 reflective loading
author: Adverse Trace
date: 2026/07/22
references:

  - https://www.crowdstrike.com/en-us/blog/denying-the-worm-sandworm-mode-and-ai-toolchain-supply-chain-attacks/
logsource:
  product: linux
  category: file_event
detection:
  selection_shm_create:
    TargetFilename|startswith: "/dev/shm/"
  selection_shm_unlink:
    TargetFilename|startswith: "/dev/shm/"
    EventType: "delete"
  condition: selection_shm_create and selection_shm_unlink
  timeframe: 30s
falsepositives:

  - Legitimate applications using /dev/shm for temporary file storage
  - Node.js applications using shared memory for IPC
level: high

title: SANDWORM_MODE npm Token Abuse - whoami and publish Sequence
id: 8b4d2f3e-9c5e-4b7f-0d6f-2e3f4a5b6c7d
status: experimental
description: Detects npm whoami API call followed by npm publish from the same host, consistent with SANDWORM_MODE propagation
author: Adverse Trace
date: 2026/07/22
references:

  - https://www.crowdstrike.com/en-us/blog/denying-the-worm-sandworm-mode-and-ai-toolchain-supply-chain-attacks/
logsource:
  product: linux
  category: process_creation
detection:
  selection_whoami:
    CommandLine|contains|all:

      - "npm"
      - "whoami"
  selection_publish:
    CommandLine|contains|all:

      - "npm"
      - "publish"
  filter_ci:
    Image|endswith:

      - "/node"
      - "/npm"
  condition: selection_whoami or selection_publish
falsepositives:

  - Legitimate npm publishing workflows
  - CI pipelines that publish packages as part of normal release process
level: medium

7. Sources

• CrowdStrike, "Denying the Worm: Detecting SANDWORM_MODE and the Emerging Class of AI Toolchain Supply Chain Attacks," https://www.crowdstrike.com/en-us/blog/denying-the-worm-sandworm-mode-and-ai-toolchain-supply-chain-attacks/, published 2026-07-21.
• CrowdStrike, "CrowdStrike Uncovers New Prompt Injection Techniques," https://www.crowdstrike.com/en-us/blog/crowdstrike-uncovers-new-prompt-injection-techniques/ (related context).
• Socket.dev, original SANDWORM_MODE research, February 2026 (referenced but not directly fetched; cited within the CrowdStrike source).

8. Adverse Trace position

SANDWORM_MODE represents a meaningful escalation in supply chain attack sophistication: it specifically targets the convergence of AI-augmented development workflows and ephemeral CI/CD environments, exploiting the fact that malicious runtime behaviour in these contexts is functionally indistinguishable from legitimate activity. The fileless Stage 2 execution via /dev/shm, the dual-path time-delay gate (delayed on workstations, immediate in CI), and the three-vector propagation using stolen npm tokens make this a high-impact threat for any organisation with active JavaScript/Node.js development. The absence of enumerated IOCs (package names, C2 domains) in the source material is a significant gap — clients should obtain the full indicator set from Socket.dev's February 2026 disclosure before enforcing blocks. We assess this as a high-severity threat to EMEA financial services development pipelines, contingent on whether the organisation uses npm and AI-augmented CI/CD. Adverse Trace will monitor for the full IOC package and for any follow-on reporting confirming attribution or additional propagation vectors. Clients with in-house Node.js development should treat P1 actions as immediate.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.