npm / AI-developer-toolchain supply-chain wave status: this week the front edge moved from poisoning packages to poisoning the AI coding assistant's own trust config, via rogue MCP tool-provider entries
UPDATE · originally covered npm / developer-ecosystem supply-chain wave status: AsyncAPI was the week's marquee compromise, and DPRK's Contagious Interview broadened the developer-as-target vector from package poisoning to CI/CD pipelines and job-interview repos (2026-07-19)
the npm / developer-ecosystem supply-chain wave this pipeline has tracked across prior weeklies added a distinct front this week, and the delta is the target layer.
Earlier stages of the wave moved from poisoning published packages with evasive install hooks (jscrambler, injectivelabs) to abusing the trust machinery around packages — the AsyncAPI compromise rode the org's own legitimate CI/CD release workflow so its trojanized versions carried cryptographically valid provenance attestations, and the DPRK-aligned Contagious Interview campaign targeted developers directly through fake job repos. This week's addition, CrowdStrike's SANDWORM_MODE, moves one layer further in: instead of poisoning a package or a pipeline, the multi-stage npm worm writes rogue Model Context Protocol (MCP) tool-provider entries into AI coding-assistant configurations — Cursor, VS Code, Claude Desktop and Windsurf — so the assistant itself loads and trusts an attacker-controlled tool provider, injects global git-template hooks for persistence, and exfiltrates npm, AWS and SSH credentials alongside multi-provider LLM API keys, delaying activation 48-96 hours on workstations to break the correlation between install time and malicious behaviour (CrowdStrike, 2026-07-21).
ATT&CK mapping
5 techniques mapped from the cited reporting · MITRE ATT&CK v19.1
Initial Access TA0001
T1195.002Supply Chain Compromise: Compromise Software Supply Chain
Adversaries may manipulate application software prior to receipt by a final consumer for the purpose of data or system compromise. Supply chain compromise of software can take place in a number of ways, including manipulation of the application source code, manipulation of the update/distribution mechanism for that software, or replacing compiled releases with a modified version.
Persistence TA0003
T1546Event Triggered Execution
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.
Privilege Escalation TA0004
T1546Event Triggered Execution
Adversaries may establish persistence and/or elevate privileges using system mechanisms that trigger execution based on specific events. Various operating systems have means to monitor and subscribe to events such as logons or other user activity such as running specific applications/binaries. Cloud environments may also support various functions and services that monitor and can be invoked in response to specific cloud events.
Stealth TA0005
T1497Virtualization/Sandbox Evasion
Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
Credential Access TA0006
T1552.001Unsecured Credentials: Credentials In Files
Adversaries may search local file systems and remote file shares for files containing insecurely stored credentials. These can be files created by users to store their own credentials, shared credential stores for a group of individuals, configuration files containing passwords for a system or service, or source code/binary files containing embedded passwords.
Discovery TA0007
T1497Virtualization/Sandbox Evasion
Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from Virtualization/Sandbox Evasion during automated discovery to shape follow-on behaviors.
Command and Control TA0011
T1071.004Application Layer Protocol: DNS
Adversaries may communicate using the Domain Name System (DNS) application layer protocol to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Update chain
AI-generated · no human review · this permalink is the shareable record for the finding · verify operationally critical claims against the linked primary source.