{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","feed_url":"https://feed.craftedsignal.io/products/anthropic/feed.json","home_page_url":"https://feed.craftedsignal.io/","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":true,"_cs_poc_references":[],"_cs_products":["npm","PyPI","GitHub Actions","GitLab CI","Bitbucket Pipelines","GitHub Copilot","Cursor","Claude Code","GitHub","OpenAI","Anthropic","Google APIs","Cloudflare Workers","Git","Cloudflare Worker","Windsurf","GitHub Secrets","OpenAI API","Anthropic API","Google API","OpenAI APIs","Anthropic APIs","Node.js","GitHub REST/GraphQL API"],"_cs_severities":["critical"],"_cs_tags":["supply-chain-attack","npm","git","ai-toolchain","development-workflow","code-injection","credential-theft","persistence","evasion"],"_cs_type":"advisory","_cs_vendors":["GitHub","GitLab","Atlassian","OpenAI","Anthropic","Google","Cloudflare","npm","PyPI","Microsoft","Cursor","Bitbucket","Windsurf","Socket.dev","CrowdStrike","npm Inc."],"content_html":"\u003cp\u003eCrowdStrike has identified a sophisticated multi-stage npm supply chain worm, internally tracked as SANDWORM_MODE, which has affected 19 malicious packages distributed across two unique publisher aliases. This campaign, active since at least February 2026, represents a new class of attacks targeting AI-augmented development workflows. Unlike typical supply chain attacks that focus on build outputs or static backdoors, SANDWORM_MODE is designed to exploit the runtime behaviors of AI coding assistants, CI automation, and large language model (LLM) toolchains. Its primary evasion technique involves multi-layer obfuscation and delayed payload unpacking, bypassing static analysis. The worm conducts reconnaissance to steal sensitive credentials, including npm tokens, environment variables (KEY, SECRET, TOKEN, PASSWORD), and cryptocurrency wallet keys, exfiltrating them to attacker-controlled Cloudflare Workers. It achieves persistence and propagates by injecting malicious code into new npm packages, modifying GitHub repositories via API or SSH, and establishing malicious Git hooks in developer environments, posing a significant threat to software development integrity.\u003c/p\u003e\n\u003ch2 id=\"attack-chain\"\u003eAttack Chain\u003c/h2\u003e\n\u003col\u003e\n\u003cli\u003eThe initial payload is delivered via a malicious npm package and employs multi-layer obfuscation (Base64, zlib, XOR) and indirect JavaScript execution methods like \u003ccode\u003eeval()\u003c/code\u003e or \u003ccode\u003eModule._compile()\u003c/code\u003e to unpack the payload at runtime, evading static analysis.\u003c/li\u003e\n\u003cli\u003eUpon activation, the loader fingerprints the runtime environment to determine if it's a developer workstation or a CI runner; CI environments trigger the next stage immediately, bypassing a time-delay gate.\u003c/li\u003e\n\u003cli\u003eThe worm performs initial reconnaissance, extracting sensitive credentials such as \u003ccode\u003e.npmrc\u003c/code\u003e tokens, environment variables matching patterns like KEY, SECRET, TOKEN, or PASSWORD, and cryptocurrency wallet keys.\u003c/li\u003e\n\u003cli\u003eHarvested cryptocurrency keys are immediately exfiltrated via an HTTP POST request to an attacker-controlled Cloudflare Worker endpoint.\u003c/li\u003e\n\u003cli\u003eA time-delay gate (48-96 hours) is initiated for developer workstations before the main payload decrypts; in CI environments, decryption occurs instantly.\u003c/li\u003e\n\u003cli\u003eThe full Stage 2 payload is decrypted using AES-256-GCM, unpacked into \u003ccode\u003e/dev/shm\u003c/code\u003e, executed via \u003ccode\u003erequire()\u003c/code\u003e, and then immediately unlinked to remove on-disk forensic artifacts.\u003c/li\u003e\n\u003cli\u003eThe worm propagates by injecting the Stage 0 loader into new npm packages published under compromised accounts, by using stolen GitHub API tokens to inject carrier dependencies and \u003ccode\u003epull_request_target\u003c/code\u003e workflows, or via SSH to clone and push code changes.\u003c/li\u003e\n\u003cli\u003ePersistence is established on developer systems by writing malicious \u003ccode\u003epre-commit\u003c/code\u003e and \u003ccode\u003epre-push\u003c/code\u003e hooks to \u003ccode\u003e~/.git-templates/hooks/\u003c/code\u003e and configuring \u003ccode\u003egit config --global init.templateDir\u003c/code\u003e to point to this directory, ensuring new repositories inherit the hooks.\u003c/li\u003e\n\u003c/ol\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe SANDWORM_MODE campaign critically compromises AI-augmented software development lifecycles by infecting widely used package registries and source control platforms. Successful attacks lead to the theft of sensitive credentials such as npm tokens, GitHub API keys, and cryptocurrency wallets, which can be used for further supply chain attacks or financial gain. Organizations face significant risks including the distribution of poisoned software dependencies to downstream consumers, unauthorized code modifications in source repositories, and persistent compromise of developer workstations and CI/CD pipelines. The stealthy nature of the attack, particularly its evasion of static analysis and ephemeral execution, makes detection challenging and increases the potential for widespread and long-lasting damage across the software supply chain.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cul\u003e\n\u003cli\u003eDeploy the provided Sigma rules to your SIEM and tune for your environment to detect suspicious \u003ccode\u003egit\u003c/code\u003e and \u003ccode\u003enpm\u003c/code\u003e activities.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003eprocess_creation\u003c/code\u003e logs for suspicious modifications to \u003ccode\u003egit config --global init.templateDir\u003c/code\u003e as described in \u003ccode\u003eDetect Git Global Template Directory Modification for Persistence\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eEnable \u003ccode\u003efile_event\u003c/code\u003e logging for creation/modification events in \u003ccode\u003e~/.git-templates/hooks/\u003c/code\u003e directories to activate the \u003ccode\u003eDetect Suspicious Git Hook Creation\u003c/code\u003e rule.\u003c/li\u003e\n\u003cli\u003eMonitor \u003ccode\u003eprocess_creation\u003c/code\u003e logs for \u003ccode\u003enpm publish\u003c/code\u003e commands originating from unexpected users or processes, as targeted by \u003ccode\u003eDetect Suspicious npm Publish Activity\u003c/code\u003e.\u003c/li\u003e\n\u003cli\u003eImplement strong credential management and regularly rotate API tokens and \u003ccode\u003e.npmrc\u003c/code\u003e credentials, especially in CI/CD environments.\u003c/li\u003e\n\u003cli\u003eUtilize security scanning tools capable of dynamic analysis and runtime monitoring to detect highly obfuscated and time-delayed payloads that evade static analysis.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-07-21T19:15:40Z","date_published":"2026-07-21T17:23:33Z","id":"https://feed.craftedsignal.io/briefs/2026-07-sandworm-mode-ai-supply-chain/","summary":"The SANDWORM_MODE campaign is a multi-stage npm supply chain worm that targets AI-augmented development workflows by exploiting runtime behaviors of AI coding assistants and CI/CD pipelines, leading to credential theft, supply chain poisoning, and persistence through obfuscated loaders, credential harvesting, and malicious Git hooks.","title":"Denying the Worm: Detecting SANDWORM_MODE and AI Toolchain Supply Chain Attacks","url":"https://feed.craftedsignal.io/briefs/2026-07-sandworm-mode-ai-supply-chain/"}],"language":"en","title":"CraftedSignal Threat Feed - Anthropic","version":"https://jsonfeed.org/version/1.1"}