AI Risk Wire

Cases › security breach › LR-2026-0417

SANDWORM_MODE npm worm targets AI packages and spreads via MCP server

Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report

Status: action reported, no fix

Severity moderate
Reported 23 Feb 2026

No source states: loss or records, developer and model, agent tool, could do, deployer, industry.

Socket described SANDWORM_MODE, a Shai-Hulud-like npm worm delivered through a cluster of at least 19 malicious packages. The packages harvested developer credentials and cryptocurrency keys, and the malware propagated through stolen npm and GitHub identities. One module injected a malicious MCP server into AI coding assistants, with a prompt injection that targeted SSH keys, AWS credentials and .env files. The destructive routine was off by default in the samples analysed. Scanners flagged the packages within minutes of publication, and all known malicious packages were later removed from npm. Users were advised to remove the packages and rotate npm, GitHub and CI tokens.

What happened

1 · What it reached or didThe code was designed to take tokens and secrets from developer machines and spread to further packages and repositories.
2 · How it was caughtScanners flagged the packages within two to five minutes of their publication on npm.

What was done

All known malicious packages were taken down and removed from npm.

Risks

Data leaked or sent out
Primary32 incidents

Read from the sources; not yet reviewed by a person.

Controls

Not yet read for controls. Controls that mitigate the primary risk:

Harness

Network egress control

Application

Sensitive-data checks on outbound data · Output filtering and redaction · Human approval for high-impact actions · Data minimisation · Least-privilege access for the agent · Activity logs

Evidence

No source states: what the AI was doing, what went wrong, when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.

Show the full account: 3 items from the primary sources

What happened, in order

Not dated in the sources:

  • Scanners flagged the malicious packages two to five minutes after npm publication.
  • The second stage of the malware is set to activate only after 48 hours plus up to 48 hours of per-machine jitter.
  • All known malicious packages were taken down and are no longer available on npm.
Show every field, with its source and grade

What happened

Earliest source we hold
2026-02-23
D inferred by us from the described behaviour, reason shown
What went wrong
security breach
C one secondary source states it
primary risk
RK04
D inferred by us from the described behaviour, reason shown

Impact

Severity
moderate
D inferred by us from the described behaviour, reason shown

Notes on gaps

No date of occurrence is stated; the sources say only that the attack was from last week relative to the Endor article. The wiper and polymorphic engine were disabled in the analysed samples. Endor notes the MCP server only saved credentials locally and had no network exfiltration of its own in the analysed version.

LR-2026-0417 · version 1 · published 2026-11-01 after automatic checks; not yet checked field by field by a person · JSON