A sophisticated software supply chain attack has demonstrated how cyber criminals are moving from traditional malware to target the automated workflows that underpin much of modern software development.
The malware known as SANDWORM_MODE was first identified by Socket.dev in February 2026 and recently further analysed by cyber security firm CrowdStrike.
Unlike conventional supply chain attacks that focus on inserting malicious code into software packages or stealing credentials, SANDWORM_MODE was designed to exploit increasingly common AI coding assistants.
“As AI coding agents become the standard for software development, adversaries are learning to live off the AI toolchain by exploiting the same trusted workflows developers use every day,” Adam Meyers, head of counter adversary operations at CrowdStrike, told Cyber Daily.
“Think of it like discovering a novel pathogen. It exposes a new attack vector and a weakness in the AI development ecosystem that the security community needs to understand and address together.”
The malware operates as a multi-stage worm distributed through malicious npm packages. After being deployed, it first gathers information about its environment, stealing credentials, API tokens and other secrets before activating a second stage that expands its capabilities.
The worm can spread automatically through compromised package repositories and source code platforms, establish persistence on developer systems and tamper with AI coding assistants by installing rogue tool servers that instruct them to expose sensitive data.
The malware also searches for password manager data, SQLite stores and clipboard history before attempting to exfiltrate the information through multiple channels. If those attempts fail, it includes a destructive fallback to erase user files.
Because many of the malware’s actions closely resemble normal developer activity, distinguishing malicious behaviour from legitimate workflows becomes significantly more difficult.
CrowdStrike said its analysis found the most reliable detections relied on correlating process behaviour with highly specific targets, rather than searching for individual malicious files or signatures. However, many of the worm’s techniques could not be reliably detected using existing telemetry, highlighting the limitations of traditional endpoint monitoring in AI-driven development environments.
According to CrowdStrike, protecting software supply chains now requires securing package repositories, source control platforms, CI/CD systems, AI assistants and the credentials that connect them, while monitoring for unusual behaviour across the entire development pipeline rather than isolated components.
“Organisations need to extend security into the AI development life cycle. That starts with protecting developer identities and credentials, increasing visibility across package repositories and CI/CD pipelines, and isolating AI development environments where appropriate,” Meyers said.
Meyers added that due to SANDWORM_MODE and similar malware’s ability to blend into normal activity, defenders need behavioural visibility that can separate legitimate automation from adversary automation.
“AI coding assistants and attacks like SANDWORM_MODE generate much of the same telemetry, making it extremely difficult to distinguish legitimate behaviour from malicious behaviour using traditional approaches alone,” Meyers said.
“AI has poured gasoline on an existing supply chain problem, and security has to evolve alongside it.”
You can read CrowdStrike’s full analysis here.
Want to see more stories from trusted news sources?Make Cyber Daily a preferred news source on Google.
David Hollingworth
David Hollingworth has been writing about technology for over 20 years, and has worked for a range of print and online titles in his career. He is enjoying getting to grips with cyber security, especially when it lets him talk about Lego.