SANDWORM_MODE — an npm supply-chain worm that 'lives off the AI toolchain', poisoning MCP servers in AI coding assistants to steal developer credentials
CrowdStrike's research describes SANDWORM_MODE as a multi-stage npm supply-chain worm (first discovered February 2026) that targets AI-augmented developer workflows rather than only conventional package distribution or build systems — what CrowdStrike frames as "living off the AI toolchain," abusing the normalised runtime behaviours of AI coding assistants, CI automation and LLM tooling so its actions blend into legitimate developer telemetry (CrowdStrike, 2026-07-21). On install the worm writes unexpected entries into AI coding-assistant configuration files (Claude Desktop, Cursor, VS Code, Windsurf) that register a rogue Model Context Protocol (MCP) tool provider staged in a hidden directory, and it injects hooks under the global git-template hooks path so persistence fires on future git operations. It then harvests credentials from environment variables and .env/SSH-key files — npm tokens, AWS keys, SSH keys, and API keys for multiple LLM providers — fingerprints the host to separate developer workstations from CI runners, and delays full activation 48–96 hours on workstations (immediately on CI) specifically to defeat tools that correlate install-time and behaviour signals, falling back to DNS tunnelling when primary exfiltration is blocked (SecurityBrief, 2026-07-22). The load-bearing defender lesson is CrowdStrike's own candour: of 14 investigated behaviours only 9 produced any signal and only 2 met the fidelity bar for customer-visible alerting, because npm publishes, repo pushes, LLM-API calls, credential handling and file writes overlap heavily with legitimate developer and CI activity (CrowdStrike, 2026-07-21).
SANDWORM_MODE introduces an analogous pattern for AI-augmented development environments: living off the AI toolchain.
Of 14 investigated behaviors, only 9 could produce any signal, and only 2 met the fidelity bar for customer-visible alerting.
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1195.002Supply Chain Compromise: Compromise Software Supply Chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Persistence TA0003
T1546Event Triggered Execution
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.
Privilege Escalation TA0004
T1546Event Triggered Execution
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.
Stealth TA0005
T1497Virtualization/Sandbox Evasion
Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
Credential Access TA0006
T1552.001Unsecured Credentials: Credentials In Files
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Discovery TA0007
T1497Virtualization/Sandbox Evasion
Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
Command and Control TA0011
T1071.004Application Layer Protocol: DNS
Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.