SANDWORM_MODE
SANDWORM_MODE is an active “Shai-Hulud-like” npm supply-chain worm campaign (as reported by Socket) that weaponized at least 19 malicious/typosquatted npm packages (published by the npm accounts “official334” and “javaorg”). The packages execute on import and are designed to steal developer and CI/CD secrets (including npm and GitHub tokens, CI secrets, environment secrets, access tokens, API keys, and cryptocurrency keys/material), then self-propagate by abusing stolen npm/GitHub identities to publish additional malicious packages and inject into GitHub repositories.
The operation is described as multi-stage: an initial stage rapidly harvests and exfiltrates npm/GitHub tokens and crypto keys (including exfiltration via HTTP POST to a Cloudflare Worker), followed by a delayed second stage on developer machines (reported as 48 hours plus per-machine jitter up to an additional 48 hours; also described as 48–96 hours) that expands collection (e.g., password managers, local SQLite stores, files) and adds worm-like propagation and persistence. In CI environments, the time gate is reported to be bypassed and the full payload runs immediately, including a weaponized GitHub Action that harvests CI/CD secrets and exfiltrates via HTTPS with DNS fallback. Persistence is reported via git hook-based mechanisms (including global git hooks via init.templateDir), and propagation includes GitHub API abuse and an SSH-based fallback.
A notable capability is tampering with AI coding assistants via an “McpInject” module: it writes and injects a malicious Model Context Protocol (MCP) server into configurations for Claude Code, Claude Desktop, Cursor, VS Code Continue, and Windsurf. The malicious MCP server masquerades as a legitimate tool provider and registers tools (reported as index_project, lint_check, and scan_depencies) containing embedded prompt-injection content intended to coerce AI agents into reading and staging sensitive local files such as ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.aws/credentials, ~/.npmrc, and .env for later exfiltration. The campaign is reported to target LLM API keys for multiple providers, including OpenAI, Anthropic, Google, Groq/Grok (both spellings appear in the content), Together, Fireworks, Replicate, Mistral, and Cohere.
The malware is also reported to include (currently disabled) advanced features: a polymorphic engine configured to use a local Ollama instance with the DeepSeek Coder model to rewrite code for evasion, and a destructive “dead switch”/wiper routine capable of wiping the home directory if it loses access to GitHub and npm (off by default in observed samples).
Known affected npm packages/versions listed in the content (no safe versions claimed) include: claud-code@0.2.1, cloude-code@0.2.1, cloude@0.3.0, crypto-locale@1.0.0, crypto-reader-info@1.0.0, detect-cache@1.0.0, format-defaults@1.0.0, hardhta@1.0.0, locale-loader-pro@1.0.0, naniod@1.0.0, node-native-bridge@1.0.0, opencraw@2026.2.17, parse-compat@1.0.0, rimarf@1.0.0, scan-store@1.0.0, secp256@1.0.0, suport-color@1.0.1, veim@2.46.2, and yarsg@18.0.1. Additional “sleeper” packages noted as not incorporating malicious features at the time of reporting are: ethres, iru-caches, iruchache, and uudi. A related malicious GitHub Action is referenced as ci-quality/code-quality-check (also referenced as ci-quality/code-quality-check@v1), with a threat-actor GitHub org “ci-quality” created on Feb. 17, 2026. Cloudflare workers and the associated npm/GitHub artifacts were reported as removed after notification.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
32 distinct techniques documented for this family, organized by ATT&CK tactic.
Reconnaissance
1 technique
Reconnaissance
An active Shai-Hulud-like supply chain worm campaign spreads via typosquatting and AI toolchain poisoning, across at least 19 malicious npm packages... One representative example, suport-color@1.0.1, impersonates supports-color... Other packages in the set follow the same look-alike branding strategy to increase the likelihood of accidental installation.
Resource Development
1 technique
Resource Development
Initial Access
4 techniques
Initial Access
The malicious code embedded into the packages comes with capabilities to siphon system information, access tokens, environment secrets, and API keys from developer environments and automatically propagate by abusing stolen npm and GitHub identities to extend its reach.
The code follows hallmarks analyzed in prior Shai-Hulud variants, including credential theft from developer and CI environments and automated propagation by abusing stolen npm and GitHub identities to move laterally through the software supply chain.
Execution
2 techniques
Execution
Persistence
7 techniques
Persistence
...persists via git hooks that survive into future repositories through a global init.templateDir setting... It hardens persistence by setting git config --global init.templateDir so new repositories inherit malicious hooks automatically.
The malicious code embedded into the packages comes with capabilities to siphon system information, access tokens, environment secrets, and API keys from developer environments and automatically propagate by abusing stolen npm and GitHub identities to extend its reach.
"...self-propagates by leveraging harvested npm and GitHub tokens to publish the malicious package through victims’ npm accounts or inject itself into the victim’s GitHub repos."
The packages go beyond npm-based propagation by including a weaponized GitHub Action that harvests CI/CD secrets...
Privilege Escalation
6 techniques
Privilege Escalation
...persists via git hooks that survive into future repositories through a global init.templateDir setting... It hardens persistence by setting git config --global init.templateDir so new repositories inherit malicious hooks automatically.
The malicious code embedded into the packages comes with capabilities to siphon system information, access tokens, environment secrets, and API keys from developer environments and automatically propagate by abusing stolen npm and GitHub identities to extend its reach.
"...self-propagates by leveraging harvested npm and GitHub tokens to publish the malicious package through victims’ npm accounts or inject itself into the victim’s GitHub repos."
The packages go beyond npm-based propagation by including a weaponized GitHub Action that harvests CI/CD secrets...
Stealth
5 techniques
Stealth
Socket AI Scanner’s analysis... highlights an obfuscated import-time loader... a large embedded base64 blob is decompressed with zlib.inflateSync() and executed via eval()... base64 decode + zlib inflate + XOR decrypt + indirect eval().
Another significant component of the malware is an "McpInject" module that specifically targets AI coding assistants by deploying a malicious model context protocol (MCP) server and injecting it into their tool configurations. The MCP server masquerades as a legitimate tool provider...
The malicious code embedded into the packages comes with capabilities to siphon system information, access tokens, environment secrets, and API keys from developer environments and automatically propagate by abusing stolen npm and GitHub identities to extend its reach.
Defense Impairment
1 technique
Defense Impairment
Credential Access
5 techniques
Credential Access
The code follows hallmarks analyzed in prior Shai-Hulud variants, including credential theft from developer and CI environments... On import, Stage 1 immediately performs a lightweight credential harvest (collectAll: npm tokens, GitHub tokens, environment secrets, crypto keys).
The malicious code embedded into the packages comes with capabilities to siphon system information, access tokens, environment secrets, and API keys from developer environments... It also harvests API keys for nine large language models (LLM) providers.
Once the time gate opens, Stage 2 performs deep harvesting: password managers (Bitwarden, 1Password, LastPass via their respective CLIs)... | As a secondary collection step, the module also harvests API keys for nine LLM providers... from environment variables and .env files...
The module then injects this server into every AI coding assistant config it finds on disk: Claude Code..., Cursor..., VS Code Continue..., and Windsurf/Codeium... Each gets a mcpServers entry pointing to the deployed server.js.
The MCP server masquerades as a legitimate tool provider and registers three seemingly-harmless tools, each of which embeds a prompt injection to read the contents of ~/.ssh/id_rsa, ~/.ssh/id_ed25519, ~/.aws/credentials, ~/.npmrc, and .env files.
Discovery
2 techniques
Discovery
Lateral Movement
2 techniques
Lateral Movement
Command and Control
2 techniques
Command and Control
Exfiltration
5 techniques
Exfiltration
The sample retains Shai-Hulud hallmarks and adds GitHub API exfiltration with DNS fallback... exfiltrates data via the GitHub API with DNS tunneling as a secondary channel.
"...with DNS tunneling as a fallback method."
It then exfiltrates all collected data... through three channels in cascade: HTTPS POST to a Cloudflare Worker..., authenticated GitHub API uploads to threat actor-created private repositories..., and DNS tunneling...
Impact
1 technique
Impact
The payload also implements a Shai-Hulud-style dead switch... triggers home directory wiping when the malware simultaneously loses access to GitHub for exfiltration and npm for propagation or operation... When enabled, it would securely destroy all writable files in the user's home directory...
IOCs tracked for this family
10 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
3 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An npm supply-chain, self-propagating info-stealing worm distributed via typosquatted npm packages. It runs in two stages: Stage 1 rapidly harvests and exfiltrates npm/GitHub tokens and crypto keys; Stage 2 (48–96 hours later or immediately in CI) expands theft to password managers, local SQLite stores/files, and LLM API keys, and injects a malicious MCP server with prompt-injection tool descriptions to coerce AI coding assistants into collecting and leaking credentials. It propagates by using stolen npm/GitHub tokens to publish malicious packages and inject into GitHub repos, and uses git hook-based persistence.
Multi-stage npm supply-chain worm that executes on import, steals developer/CI/cloud/crypto/LLM credentials, poisons GitHub Actions workflows and release tooling, persists via global git hooks, propagates by injecting dependencies and patching lockfiles, and tampers with AI coding assistants via rogue MCP server injection to exfiltrate secrets (e.g., SSH keys, AWS creds).
npm-repository worm that exfiltrates credentials and attempts to self-propagate by publishing to additional npm packages when the infected victim has maintainer access.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.