# SANDWORM_MODE npm Typosquatting Worm — CI Workflow Hijacking, MCP Server Injection into AI Coding Assistants, GitHub Actions Propagation

> A sophisticated npm typosquatting worm campaign publishes malicious packages mimicking trusted utilities and AI coding tools. Once installed, the worm harvests npm/GitHub tokens and CI environment secrets, then self-propagates by injecting dependencies into repositories and modifying GitHub Actions workflows. A novel MCP server injection module targets AI coding assistants (Claude Code, Cursor, Continue, Windsurf/Codeium) with prompt-injection payloads designed to exfiltrate sensitive files and secrets via rogue local MCP servers.

- **Published:** 2026-02-26T13:25:00Z
- **Last reviewed:** 2026-02-26T13:25:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0147
- **ID:** TL-2026-0147
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** DORMANT
- **Detections:** 9 · **IOCs:** 12 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SANDWORM_MODE is a self-propagating npm supply chain worm discovered by Socket Security in February 2026. The campaign publishes typosquatted packages on the npm registry that mimic trusted utilities and popular AI coding tool packages. When a developer installs one of these packages, it executes a staged payload that: (1) harvests npm authentication tokens from .npmrc files and GitHub personal access tokens from environment variables and credential stores, (2) enumerates CI environment secrets including GITHUB_TOKEN, NPM_TOKEN, and cloud provider credentials, (3) uses stolen tokens to modify victim repositories by injecting malicious dependencies into package.json files, (4) adds or modifies GitHub Actions workflows to reference a malicious action (ci-quality/code-quality-check@v1) that serves as a CI amplification mechanism collecting additional secrets and propagating the worm further.

The most notable capability is the MCP server injection module. This module targets AI coding assistant configurations on the infected developer workstation. It writes a rogue local MCP server and inserts it into configuration files for Claude Code (.claude/settings.json, .mcp.json), Cursor (.cursor/mcp.json), Continue (.continue/config.json), and Windsurf/Codeium (.codeium/config.json, .windsurf/mcp.json). The injected MCP server tool descriptions embed prompt-injection text designed to coerce AI assistants into collecting sensitive local files (SSH keys, .env files, cloud credentials, source code) and passing them to the rogue server for exfiltration. This represents the first known worm to weaponize AI development toolchains at scale.

The worm includes feature flags and a destructive dead-switch capability that, when enabled, could wipe local npm caches, delete node_modules directories, and corrupt package-lock.json files across all projects. In the observed builds, this destructive routine is disabled by default, suggesting iterative development and testing by the threat actor. The campaign has been attributed to a financially motivated actor based on the infrastructure patterns and monetization of stolen credentials.

The malicious GitHub Action ci-quality/code-quality-check@v1 is designed to appear as a legitimate code quality tool. It runs in CI environments, collecting GITHUB_TOKEN and other repository secrets, then uses them to fork the repository and inject the worm's dependencies — creating a cascading supply chain compromise that amplifies with each infected repository.

Socket Security coordinated with npm and GitHub to remove the known malicious packages and the ci-quality organization. However, the self-propagating nature means secondary infections in developer environments and CI pipelines may persist beyond package removal. Organizations should audit their CI workflows for references to ci-quality actions and scan .mcp.json and AI assistant config files for unauthorized MCP server definitions.

## MITRE ATT&CK

- T1195.002 Compromise Software Supply Chain
- T1059.007 JavaScript
- T1204.002 Malicious File
- T1546.001 Change Default File Association
- T1098 Account Manipulation
- T1552.001 Credentials In Files
- T1528 Steal Application Access Token
- T1056 Input Capture
- T1083 File and Directory Discovery
- T1091 Replication Through Removable Media
- T1005 Data from Local System
- T1530 Data from Cloud Storage
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction
- T1036.005 Match Legitimate Resource Name or Location
- T1608.001 Upload Malware

## Sources

- [Wiz Cloud Threat Landscape — SANDWORM_MODE Campaign](https://threats.wiz.io/all-incidents/sandwormmode-typosquatted-npm-packages-used-to-hijack-ci-workflows)
- [Socket Security — SANDWORM_MODE npm Typosquatting Worm Analysis](https://socket.dev/blog/sandworm-mode-npm-typosquatting-worm)
- [Malicious GitHub Action — ci-quality/code-quality-check@v1](https://github.com/ci-quality/code-quality-check)
- [npm Security Advisory — Typosquatted Package Removals (Feb 2026)](https://github.com/npm/cli/security)
- [MITRE ATT&CK — Supply Chain Compromise (T1195.002)](https://attack.mitre.org/techniques/T1195/002/)
- [Threadlinqs — TL-2026-0146 Claude Code RCE (related: MCP config abuse)](https://intel.threadlinqs.com/threat/TL-2026-0146)
- [Threadlinqs — TL-2026-0139 Malicious Next.js Repositories (related: supply chain repos)](https://intel.threadlinqs.com/threat/TL-2026-0139)
- [Threadlinqs — TL-2026-0136 Malicious OpenClaw Skills AMOS (related: dev tool supply chain)](https://intel.threadlinqs.com/threat/TL-2026-0136)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0147