Skip to content
Threat Feed
Subscribe

Vendor

Socket.dev

1 brief RSS
critical advisory

Denying the Worm: Detecting SANDWORM_MODE and AI Toolchain Supply Chain Attacks

The SANDWORM_MODE campaign is a multi-stage npm supply chain worm that targets AI-augmented development workflows by exploiting runtime behaviors of AI coding assistants and CI/CD pipelines, leading to credential theft, supply chain poisoning, and persistence through obfuscated loaders, credential harvesting, and malicious Git hooks.

PoC npm +23 supply-chain-attack git ai-toolchain development-workflow code-injection credential-theft persistence evasion
3r 14t 1i