Skip to content
Threat Feed
Subscribe

Product

Node.js Runtime

2 briefs RSS
critical advisory

Denying the Worm: Detecting SANDWORM_MODE and AI Toolchain Supply Chain Attacks

The SANDWORM_MODE campaign is a multi-stage npm supply chain worm that targets AI-augmented development workflows by exploiting runtime behaviors of AI coding assistants and CI/CD pipelines, leading to credential theft, supply chain poisoning, and persistence through obfuscated loaders, credential harvesting, and malicious Git hooks.

PoC npm +60 supply-chain-attack git ai-toolchain development-workflow code-injection credential-theft persistence evasion
3r 14t 57i updated
high threat

Lazarus Group's Brandjacking Campaign on npm Delivers Persistent Node.js Backdoor

The Lazarus Group is conducting a brandjacking campaign on npm, using dozens of malicious packages like 'buffer-utilities' to deploy a Node.js backdoor that collects host information, establishes C2 communication, and maintains persistent attacker-controlled code execution, primarily targeting developers.

npm package manager +1 Lazarus Group +4 supply-chain-attack npm brandjacking Lazarus-Group nodejs malware
3r 5t 1i