A sophisticated supply chain worm campaign codenamed SANDWORM_MODE is actively targeting the npm ecosystem. This campaign uses malicious packages to harvest cryptocurrency keys, CI/CD secrets, and API tokens from developer environments.

Overview of the SANDWORM_MODE Campaign

The campaign is described as a “Shai-Hulud-like” worm, referring to a series of evolving supply chain attacks that first emerged in late 2025. It employs automated propagation by siphoning npm and GitHub identities from infected systems to publish malicious updates to other packages maintained by the victim.

• Primary Targets: Cryptocurrency wallets (MetaMask, Phantom), GitHub Personal Access Tokens (PATs), AWS keys, SSH keys, and LLM API keys.
• AI Toolchain Poisoning: This 2026 variant specifically targets AI coding tools like Claude Code and Cursor by injecting malicious Model Context Protocol (MCP) servers to maintain persistence.
• Propagation Method: Uses stolen credentials to automatically republish legitimate packages with malicious code, creating an exponential spread across the registry.

Malicious Package Tactics

Recent reports identify several waves of attacks using different delivery methods:

• Typosquatting & Impersonation: Packages like bitcoin-main-lib, bitcoin-lib-js, and polymarket-clob masquerade as legitimate libraries to trick developers.
• Persistence Mechanisms: The malware often includes a “time bomb” to stay dormant for up to 48 hours before executing, and it uses git hooks to persist across new repositories.
• Advanced Exfiltration: Data is exfiltrated via the GitHub API, Discord servers (NodeCordRAT), or through DNS tunneling to bypass standard network filters.

High-Profile Impact (2025–2026)

Incident Date	Key Affected Packages / Entities	Impact
February 2026	Cline CLI, OpenClaw	Compromised CLI package installed unauthorized AI agents.
January 2026	react-codeshift(Hallucinated)	AI-generated “slopsquatting” where AI agents requested non-existent packages.
December 2025	Shai-Hulud V2	Over 700 packagescompromised, exposing ~14,000 secrets.
September 2025	chalk, debug, ansi-styles	Maintainer account phished; malicious updates hit billions of weekly downloads.

Recommended Remediation Steps

If you suspect an infection or have used a compromised package:

1. Immediate Removal: Run npm uninstall <package-name> and delete node_modules and lock files.
2. Credential Rotation: Immediately rotate ALLsecrets found in .env files, including API keys and SSH private keys.
3. Financial Security: Transfer funds from potentially compromised cryptocurrency wallets to new addresses with fresh seed phrases.
4. Audit Accounts: Check GitHub and npm accounts for unauthorized new repositories or added SSH keys.
5. Enable OIDC: Switch to OpenID Connect (OIDC)for npm publishing to avoid long-lived tokens.