New Shai-Hulud–like npm Worm Attack 19+ Packages to Steal dev/CI Secrets

A new supply chain worm is currently targeting the npm ecosystem. Research has identified at least 19 malicious npm packages intended to steal developer and CI/CD secrets and autonomously spread across repositories and workflows.

The campaign, known as SANDWORMMODE, employs typosquatted npm packages and compromised GitHub Actions to attack developer machines and CI pipelines . Attackers disguise these packages as popular Node.js utilities and AI coding tools , using two npm publisher aliases.

The malicious packages maintain their expected functionality while executing a multi-stage JavaScript payload upon import, which activates during the npm install command. This results in the theft of sensitive data, including npm and GitHub tokens, environment variables, and cryptographic keys.

Theme Earlier Shai-Hulud Worm SANDWORM_MODE Variant

How it spreads (entry point) Used malicious npm packages Used fake (typosquat) npm packages

Who it targets Developers and CI systems Developers and CI; mimics trusted packages

When it runs During normal package use Upon import, retains normal library functions

Structure Multi-stage (loader + payload) Multi-stage with encrypted second stage

Obfuscation Hides code with runtime tricks Uses Base64, compression, XOR, AES encryption

What it steals Developer and CI credentials npm/GitHub tokens, env secrets, .npmrc creds

How it sends data out Works even in restricted networks Uses GitHub API, DNS tunneling, HTTPS endpoints

How it spreads further Uses stolen npm/GitHub accounts Modifies repos, injects package.json, lockfiles

CI attacks Uses CI to spread Injects malicious workflows, steals secrets

Destructive feature Optional destructive mode Wipes home directory if access is lost

Operator control Configurable settings Many SANDWORM_* environment variable controls

Theme/branding Dune/sandworm naming Uses SANDWORM_* themed switches

Persistence Different methods Uses git hooks for infection inheritance

Backup spreading method Not always highlighted Uses SSH if API spreading fails

AI tool targeting Not a major focus Targets AI tools, injects configs

Self-rewriting Not emphasized Can rewrite itself using local Ollama

The attack utilizes a multi-stage data theft process:

Stage Activity Details

Stage 1 – Fast Secret Harvesting Initial Data Theft Scans .npmrc files, environment variables, configuration files, and crypto wallets.

Stage 1 – Fast Secret Harvesting Exfiltration Sends discovered secrets to a remote server via a Cloudflare Worker endpoint.

Stage 2 – Deep Harvesting Extended Data Collection Searches password managers, local SQLite databases, and wallet files for additional sensitive data.

Stage 2 – Deep Harvesting Exfiltration Method Transfers stolen data over HTTPS, with DNS tunneling as a fallback method.

Stolen credentials enable the worm to propagate further. If GitHub API access is restricted, the malware resorts to an SSH fallback method, exploiting the victim’s SSH agent to clone repositories and modify them with the carrier dependency.

The worm also targets AI coding tools by installing a rogue MCP server in configurations for tools such as Claude Code, Cursor, and VS Code extensions. It uses hidden prompt injection instructions to manipulate AI assistants into revealing SSH keys, cloud credentials, and tokens.

The campaign includes a disabled “dead switch” feature, illustrating ongoing evolution of the malware, and poses significant risks to development and CI environments.

For further details on the SANDWORMMODE campaign, visit the Sockets Threat Research Team's report .

Based on reporting by Cyber Security News.