Denying the Worm: Detecting SANDWORM_MODE and AI Toolchain Supply Chain Attacks

CrowdStrike has identified a sophisticated multi-stage npm supply chain worm, internally tracked as SANDWORM_MODE, which has affected 19 malicious packages distributed across two unique publisher aliases. This campaign, active since at least February 2026, represents a new class of attacks targeting AI-augmented development workflows. Unlike typical supply chain attacks that focus on build outputs or static backdoors, SANDWORM_MODE is designed to exploit the runtime behaviors of AI coding assistants, CI automation, and large language model (LLM) toolchains. Its primary evasion technique involves multi-layer obfuscation and delayed payload unpacking, bypassing static analysis. The worm conducts reconnaissance to steal sensitive credentials, including npm tokens, environment variables (KEY, SECRET, TOKEN, PASSWORD), and cryptocurrency wallet keys, exfiltrating them to attacker-controlled Cloudflare Workers. It achieves persistence and propagates by injecting malicious code into new npm packages, modifying GitHub repositories via API or SSH, and establishing malicious Git hooks in developer environments, posing a significant threat to software development integrity.

Attack Chain

1. The initial payload is delivered via a malicious npm package and employs multi-layer obfuscation (Base64, zlib, XOR) and indirect JavaScript execution methods like eval() or Module._compile() to unpack the payload at runtime, evading static analysis.
2. Upon activation, the loader fingerprints the runtime environment to determine if it's a developer workstation or a CI runner; CI environments trigger the next stage immediately, bypassing a time-delay gate.
3. The worm performs initial reconnaissance, extracting sensitive credentials such as .npmrc tokens, environment variables matching patterns like KEY, SECRET, TOKEN, or PASSWORD, and cryptocurrency wallet keys.
4. Harvested cryptocurrency keys are immediately exfiltrated via an HTTP POST request to an attacker-controlled Cloudflare Worker endpoint.
5. A time-delay gate (48-96 hours) is initiated for developer workstations before the main payload decrypts; in CI environments, decryption occurs instantly.
6. The full Stage 2 payload is decrypted using AES-256-GCM, unpacked into /dev/shm, executed via require(), and then immediately unlinked to remove on-disk forensic artifacts.
7. The worm propagates by injecting the Stage 0 loader into new npm packages published under compromised accounts, by using stolen GitHub API tokens to inject carrier dependencies and pull_request_target workflows, or via SSH to clone and push code changes.
8. Persistence is established on developer systems by writing malicious pre-commit and pre-push hooks to ~/.git-templates/hooks/ and configuring git config --global init.templateDir to point to this directory, ensuring new repositories inherit the hooks.

Impact

The SANDWORM_MODE campaign critically compromises AI-augmented software development lifecycles by infecting widely used package registries and source control platforms. Successful attacks lead to the theft of sensitive credentials such as npm tokens, GitHub API keys, and cryptocurrency wallets, which can be used for further supply chain attacks or financial gain. Organizations face significant risks including the distribution of poisoned software dependencies to downstream consumers, unauthorized code modifications in source repositories, and persistent compromise of developer workstations and CI/CD pipelines. The stealthy nature of the attack, particularly its evasion of static analysis and ephemeral execution, makes detection challenging and increases the potential for widespread and long-lasting damage across the software supply chain.

Recommendation

• Deploy the provided Sigma rules to your SIEM and tune for your environment to detect suspicious git and npm activities.
• Monitor process_creation logs for suspicious modifications to git config --global init.templateDir as described in Detect Git Global Template Directory Modification for Persistence.
• Enable file_event logging for creation/modification events in ~/.git-templates/hooks/ directories to activate the Detect Suspicious Git Hook Creation rule.
• Monitor process_creation logs for npm publish commands originating from unexpected users or processes, as targeted by Detect Suspicious npm Publish Activity.
• Implement strong credential management and regularly rotate API tokens and .npmrc credentials, especially in CI/CD environments.
• Utilize security scanning tools capable of dynamic analysis and runtime monitoring to detect highly obfuscated and time-delayed payloads that evade static analysis.