CrowdStrike Uncovers SANDWORM_MODE: A Novel AI Toolchain Supply Chain Attack
CrowdStrike details SANDWORM_MODE, a novel supply chain attack targeting AI development toolchains by injecting malicious code into training data, potentially compromising downstream AI applications.
CrowdStrike has detailed a sophisticated new class of supply chain attacks dubbed SANDWORM_MODE, which specifically targets the burgeoning AI development toolchains. Discovered operating under an internal flag, this multi-stage worm campaign involved 19 malicious npm packages distributed across two publisher aliases. Unlike many contemporary supply chain attacks that focus on build outputs, static backdoors, or credential harvesting, SANDWORM_MODE uniquely exploits the runtime behaviors of AI coding assistants, Continuous Integration (CI) automation, and Large Language Model (LLM) toolchains.
The complexity of detecting SANDWORM_MODE lies in the fact that its malicious actions occur within environments functionally indistinguishable from legitimate operations. This makes distinguishing between normal development workflows and malicious activity a significant challenge for security teams. CrowdStrike's analysis maps the infection chain against the components of a modern AI CI/CD pipeline, highlighting the effectiveness of the attack and the difficulties in detection engineering.
Modern software development increasingly relies on AI-augmented pipelines, regardless of the specific provider like GitHub Actions, GitLab CI, or Bitbucket Pipelines, and AI assistants such as GitHub Copilot, Cursor, or Claude Code. These pipelines typically share a consistent set of components: package registries for dependency management, AI coding assistants for code generation, CI/CD runners for automation, secret stores for credentials, source control APIs for repository management, and LLM providers for backend inference. SANDWORM_MODE specifically targeted all six of these critical components.
The SANDWORM_MODE infection chain executes across three distinct stages, each designed to evade analysis at its operational boundary. Stage 0 involves an obfuscated loader employing multi-layer encoding (Base64, zlib, XOR) and indirect eval() or Module._compile() calls triggered upon package import. This stage contains no overtly malicious logic, its primary function being to unpack the payload at runtime, thereby bypassing static analysis tools that scan package contents during publication.
Upon activation, Stage 1 performs initial reconnaissance and a quick harvest of sensitive information. It fingerprints the runtime environment to determine if it's a developer workstation or a CI runner. In CI environments, the time-delay gate for Stage 2 is bypassed entirely. The worm extracts .npmrc tokens, environment variables matching specific patterns (KEY, SECRET, TOKEN, PASSWORD), and cryptocurrency wallet keys. Harvested cryptocurrency keys are immediately exfiltrated via HTTP POST requests to an attacker-controlled endpoint. A 48- to 96-hour time bomb then gates Stage 2 decryption on developer machines, ensuring delayed persistence, while CI environments trigger immediately due to their ephemeral nature.
After the time gate clears, Stage 2 decrypts the full payload using AES-256-GCM into /dev/shm, executes it via require(), and then immediately unlinks the file. This technique, analogous to reflective loading adapted for Node.js, leaves no on-disk forensic artifacts. The Stage 2 capabilities directly target the AI pipeline components, enabling propagation, persistence, and AI toolchain compromise.
Propagation occurs through three independent vectors exploiting different credential types. Stolen npm tokens are used to enumerate packages, inject the loader shim, and republish infected versions. GitHub API tokens allow enumeration of accessible repositories, injection of a carrier dependency, and execution of workflows in the context of the base repository. An SSH fallback is used when API methods are unavailable, directly cloning repositories, injecting dependencies, and pushing changes.
Persistence is established by writing malicious pre-commit and pre-push hooks to ~/.git-templates/hooks/ and configuring git config --global init.templateDir to point to this directory. This ensures that every future git init or clone operation on the compromised system automatically inherits the infected hooks, propagating SANDWORM_MODE into any new repository without further user interaction. The worm also deploys a rogue MCP server and injects configuration entries into AI assistant tools like Claude Desktop, Cursor, VSCode, and Windsurf, registering the rogue server as a trusted provider, thereby compromising the AI toolchain itself.