CrowdStrike has published research on SANDWORM_MODE, describing it as malware designed to exploit AI-augmented software development environments and showing how AI coding assistants and related toolchains are becoming a software supply chain target.
The company’s analysis follows February 2026 research by Socket.dev into a multi-stage npm supply chain worm that used the internal flag SANDWORM_MODE. Socket.dev reported the campaign involved 19 malicious packages across two publisher aliases and focused on AI-assisted development workflows.
According to the CrowdStrike write-up, SANDWORM_MODE is intended to blend into trusted development activity by abusing actions AI coding assistants already perform, rather than relying on overtly unusual behaviour that might trigger security alerts.
Key findings outlined in the research include methods to steal credentials and propagate across development projects. CrowdStrike said the malware can push attackers into AI tooling workflows, attempt credential theft affecting “nine major AI providers,” and automatically infect new developer projects. The research also notes a destructive fallback, where the malware can wipe victim files if it cannot successfully steal credentials or spread.
The report breaks the infection into three stages. Stage 0 is an obfuscated loader that uses layered encoding and runtime unpacking techniques, triggered on package import, intended to bypass static scanning at publish time. Stage 1 performs reconnaissance and a “quick harvest,” including extraction of .npmrc tokens, environment variables matching patterns such as KEY, SECRET, TOKEN or PASSWORD, and cryptocurrency wallet keys, with data sent to attacker infrastructure. A 48- to 96-hour delay is described as gating later-stage activity on developer workstations, while CI environments bypass that delay.
Stage 2, CrowdStrike said, decrypts and runs a full payload in-memory in a way intended to reduce on-disk artefacts. The company’s analysis describes propagation paths using stolen npm tokens and GitHub API tokens, including publishing infected package versions and modifying repositories via commits or pull requests, as well as an SSH-based fallback.
Beyond propagation, CrowdStrike said SANDWORM_MODE attempts persistence by writing malicious git hooks into a global template directory so that new repositories inherit infected hooks. The research also describes compromise of AI tooling by deploying a rogue Model Context Protocol server in a hidden directory and injecting configuration entries into tools including Claude Desktop, Cursor, VSCode and Windsurf to register it as a trusted provider. The rogue server is described as instructing assistants to read and exfiltrate secrets through tool interfaces. CrowdStrike also reported harvesting API keys for nine LLM providers from environment variables and .env files.
The report also details additional data collection, including targeting password manager command-line tools and local SQLite-based stores, and using multiple exfiltration channels. If propagation and exfiltration fail, the malware includes a destructive “dead switch” that attempts to shred writable user files.
CrowdStrike’s blog focuses on detection engineering challenges in AI-augmented development environments, arguing that the malicious actions can be difficult to distinguish from legitimate developer and CI automation. It said a gap analysis produced multiple detection candidates, with 65% deployed and others deemed infeasible due to telemetry constraints.
The company attributed the difficulty to attackers “living off the AI toolchain,” an analogy to “living off the land” techniques, where activity can appear indistinguishable from normal behaviour. The report argues that AI toolchain activity needs dedicated baselines, noting that without understanding typical MCP server deployments, assistant configuration changes and API key usage patterns, anomaly-based detection is limited.
CrowdStrike concluded that SANDWORM_MODE should be treated as an early example of an emerging class of attacks focused on trust relationships in AI-augmented workflows, rather than solely compromising packages. The company said the investigation produced detection content across multiple stages of the kill chain and that indicators of attack from the effort are being used to protect its customers.
