SANDWORM_MODE npm Typosquatting Worm — CI Workflow Hijacking, MCP Server Injection into AI Coding Assistants, GitHub Actions Propagation
SANDWORM_MODE npm Typosquatting Worm (TL-2026-0147), also tracked as SANDWORM_MODE, is a critical-severity supply-chain compromise, first published 2026-02-26. It has no confirmed attribution, affects npm npm Registry (typosquatted packages), maps to 18 MITRE ATT&CK techniques (T1005, T1036.005, T1056), and is covered by 9 detection rules and 12 indicators of compromise.
Key facts for TL-2026-0147
- Threat ID
- TL-2026-0147
- Also known as
- SANDWORM_MODE
- Severity
- CRITICAL
- Status
- DORMANT
- Category
- SUPPLY_CHAIN
- First published
- 2026-02-26
- Last reviewed
- 2026-02-26
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cloud, financial, all-sectors-using-npm
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 12
Malware and tooling in SANDWORM_MODE npm Typosquatting Worm
Malware and tooling: SANDWORM_MODE, Claude Code, Codeium, Continue, Cursor IDE
A sophisticated npm typosquatting worm campaign publishes malicious packages mimicking trusted utilities and AI coding tools. Once installed, the worm harvests npm/GitHub tokens and CI environment secrets, then self-propagates by injecting dependencies into repositories and modifying GitHub Actions workflows. A novel MCP server injection module targets AI coding assistants (Claude Code, Cursor, Continue, Windsurf/Codeium) with prompt-injection payloads designed to exfiltrate sensitive files and secrets via rogue local MCP servers.
How SANDWORM_MODE npm Typosquatting Worm works
SANDWORM_MODE is a self-propagating npm supply chain worm discovered by Socket Security in February 2026. The campaign publishes typosquatted packages on the npm registry that mimic trusted utilities and popular AI coding tool packages. When a developer installs one of these packages, it executes a staged payload that: (1) harvests npm authentication tokens from .npmrc files and GitHub personal access tokens from environment variables and credential stores, (2) enumerates CI environment secrets including GITHUB_TOKEN, NPM_TOKEN, and cloud provider credentials, (3) uses stolen tokens to modify victim repositories by injecting malicious dependencies into package.json files, (4) adds or modifies GitHub Actions workflows to reference a malicious action (ci-quality/code-quality-check@v1) that serves as a CI amplification mechanism collecting additional secrets and propagating the worm further.
The most notable capability is the MCP server injection module. This module targets AI coding assistant configurations on the infected developer workstation. It writes a rogue local MCP server and inserts it into configuration files for Claude Code (.claude/settings.json, .mcp.json), Cursor (.cursor/mcp.json), Continue (.continue/config.json), and Windsurf/Codeium (.codeium/config.json, .windsurf/mcp.json). The injected MCP server tool descriptions embed prompt-injection text designed to coerce AI assistants into collecting sensitive local files (SSH keys, .env files, cloud credentials, source code) and passing them to the rogue server for exfiltration. This represents the first known worm to weaponize AI development toolchains at scale.
The worm includes feature flags and a destructive dead-switch capability that, when enabled, could wipe local npm caches, delete node_modules directories, and corrupt package-lock.json files across all projects. In the observed builds, this destructive routine is disabled by default, suggesting iterative development and testing by the threat actor. The campaign has been attributed to a financially motivated actor based on the infrastructure patterns and monetization of stolen credentials.
The malicious GitHub Action ci-quality/code-quality-check@v1 is designed to appear as a legitimate code quality tool. It runs in CI environments, collecting GITHUB_TOKEN and other repository secrets, then uses them to fork the repository and inject the worm's dependencies — creating a cascading supply chain compromise that amplifies with each infected repository.
Socket Security coordinated with npm and GitHub to remove the known malicious packages and the ci-quality organization. However, the self-propagating nature means secondary infections in developer environments and CI pipelines may persist beyond package removal. Organizations should audit their CI workflows for references to ci-quality actions and scan .mcp.json and AI assistant config files for unauthorized MCP server definitions.
MITRE ATT&CK techniques used in TL-2026-0147
collection
T1005 Data from Local System; T1056 Input Capture; T1530 Data from Cloud Storage
defense-evasion
T1036.005 Match Legitimate Resource Name or Location
execution
T1059.007 JavaScript; T1204.002 Malicious File
command-and-control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer
discovery
T1083 File and Directory Discovery
lateral-movement
T1091 Replication Through Removable Media
persistence
initial-access
T1195.002 Compromise Software Supply Chain
impact
credential-access
T1528 Steal Application Access Token; T1552.001 Credentials In Files
privilege-escalation
T1546.001 Change Default File Association
exfiltration
T1567 Exfiltration Over Web Service
resource-development
Affected products and versions in SANDWORM_MODE npm Typosquatting Worm
- npm — npm Registry (typosquatted packages)
Vulnerable versions: Various typosquatted package names
Fixed in: Packages removed from registry - GitHub — GitHub Actions
Vulnerable versions: ci-quality/code-quality-check@v1
Fixed in: Organization removed - Anthropic — Claude Code
Vulnerable versions: All versions (config injection target) - Cursor — Cursor IDE
Vulnerable versions: All versions (config injection target) - Continue — Continue Extension
Vulnerable versions: All versions (config injection target) - Codeium — Windsurf/Codeium
Vulnerable versions: All versions (config injection target)
Remediation for SANDWORM_MODE npm Typosquatting Worm
Immediate actions
- Audit all npm dependencies for typosquatted packages — check recent installations against known-good package names
- Search GitHub Actions workflows for references to ci-quality/code-quality-check@v1 and remove immediately
- Scan developer workstations for unauthorized MCP server definitions in .claude/, .cursor/, .continue/, .codeium/, .windsurf/ config directories
- Rotate all npm tokens, GitHub PATs, and CI environment secrets that may have been exposed
- Review recent package.json changes across repositories for injected unknown dependencies
Workarounds
- Pin all GitHub Actions to specific commit SHAs instead of version tags
- Use npm audit and socket.dev CLI before installing packages
- Disable enableAllProjectMcpServers in Claude Code settings organization-wide
- Set NPM_CONFIG_IGNORE_SCRIPTS=true in CI to prevent postinstall script execution
Longer-term hardening
- Implement npm package provenance verification and lockfile auditing in CI/CD pipelines
- Deploy Socket Security or similar supply chain scanning to detect typosquatting packages
- Establish allowlists for GitHub Actions — only permit reviewed and pinned actions in CI workflows
- Monitor AI coding assistant config files (.mcp.json, .claude/settings.json) as part of endpoint security
- Implement MCP server allow-listing in organizational AI coding tool policies
- Enable npm 2FA on all publishing accounts and audit token scopes
Weaknesses (CWE) in SANDWORM_MODE npm Typosquatting Worm
CWE-506, CWE-829, CWE-494, CWE-94
Timeline of SANDWORM_MODE npm Typosquatting Worm
- Earliest observed SANDWORM_MODE typosquatted packages published to npm registry based on package creation timestamps
- Malicious GitHub Action ci-quality/code-quality-check@v1 created and linked to worm propagation pipeline
- MCP server injection module targeting AI coding assistants (Claude Code, Cursor, Continue, Windsurf) first observed in package builds
- npm and GitHub coordinated takedown: malicious packages removed from registry, ci-quality GitHub organization removed
- Socket Security discovers and publishes analysis of SANDWORM_MODE campaign. Wiz Cloud Threats publishes parallel analysis. Source: https://threats.wiz.io/all-incidents/sandwormmode-typosquatted-npm-packages-used-to-hijack-ci-workflows
- Wiz finalizes threat analysis. Dead-switch capability confirmed disabled in all observed builds. Feature flags suggest iterative development.
- Threadlinqs Intelligence publishes TL-2026-0147 with full MITRE mapping, simulations, and detection coverage
- As of 2026-05-29, the SANDWORM_MODE npm typosquatting worm shows no public evidence of ongoing propagation or registry resurgence and affected packages appear removed/contained. The self-propagating supply-chain class stays a broad risk, but this specific campaign is dormant (low external corroboration).
Sources cited for SANDWORM_MODE npm Typosquatting Worm
- Wiz Cloud Threat Landscape — SANDWORM_MODE Campaign
- Socket Security — SANDWORM_MODE npm Typosquatting Worm Analysis
- Malicious GitHub Action — ci-quality/code-quality-check@v1
- npm Security Advisory — Typosquatted Package Removals (Feb 2026)
- MITRE ATT&CK — Supply Chain Compromise (T1195.002)
- Threadlinqs — TL-2026-0146 Claude Code RCE (related: MCP config abuse)
- Threadlinqs — TL-2026-0139 Malicious Next.js Repositories (related: supply chain repos)
- Threadlinqs — TL-2026-0136 Malicious OpenClaw Skills AMOS (related: dev tool supply chain)
More in supply chain
- GemStuffer: AI Agent Swarm Floods RubyGems With 2,000+ Malicious Packages, Achieves RCE via RubyDoc.info Build System, Attempts API Key Theft
- OpenAI Agent Swarm ("GemStuffer") Flooded RubyGems With 2,000+ Malicious Packages, Achieved RCE on RubyDoc.info Build Servers
- GemStuffer: OpenAI Autonomous Agents Flood RubyGems With 2,000+ Malicious Packages, Abuse RubyDoc.info Build System for RCE and Target a RubyGems API-Key Cache-Leak Flaw
- Coder Module Registry Supply-Chain Compromise Distributes Credential-Stealing Malware via Cloudflare Pool Hijack (GHSA-vx42-ghc9-gw65)
- Slopsquatting: Attackers Weaponize AI-Hallucinated Package Names in Supply Chain Attacks
Detection coverage for TL-2026-0147
As of 2026-02-26, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0147 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.