Malicious npm Packages Steal Crypto Keys and CI Secrets in SANDWORM_MODE Campaign
2 min. read 
Published on
Cybersecurity firm Socket uncovered 19 malicious npm packages in the SANDWORM_MODE supply chain attack. These harvest crypto keys, CI secrets, API tokens, and target AI coding tools. The campaign evolves Shai-Hulud worms with GitHub propagation and MCP injection.
Packages like [email protected] and [email protected] use typosquatting. They grab system info, tokens, and npm/GitHub creds. A GitHub Action steals CI secrets via HTTPS or DNS fallback.
Access content across the globe at the highest speed rate.
70% of our readers choose Private Internet Access
70% of our readers choose ExpressVPN
Browse the web from multiple devices with industry-standard security protocols.
Faster dedicated servers for specific actions (currently at summer discounts)
Malware waits 48-96 hours before stage 2 activates. It then spreads using stolen identities. A kill switch can wipe home directories if C2 fails.
Attack Capabilities
First stage captures basics like SSH keys and .env files. Second stage digs deeper into password managers and propagates.
McpInject targets Claude Code, Cursor, VS Code Continue. It runs fake MCP servers with prompt injection to exfiltrate ~/.ssh/id_rsa, AWS creds, npmrc.
Polymorphic engine uses local Ollama + DeepSeek Coder to rewrite code and evade scans. Currently disabled but ready.
Packages spread via official334 and javaorg publishers. Four sleepers (ethres, iru-caches) sit dormant.
Malware Features Table
| Component | Targets | Exfiltration |
|---|---|---|
| Credential Harvest | SSH keys, .env, npmrc, AWS | HTTPS/DNS fallback |
| GitHub Action | CI/CD secrets | Stolen npm/GitHub tokens |
| McpInject | Claude, Cursor, VS Code | AI tool prompt injection |
| Propagation | npm publishes, SSH spread | Stolen identities |
| Polymorphic | Variable rename, junk code | Ollama + DeepSeek |
AI coding assistants face new risks. Malicious MCP tools read sensitive files during normal use.
Related Threats
Veracode found buildrunner-dev dropping Pulsar RAT via PNG. JFrog’s eslint-verify-plugin deploys Poseidon (Linux) and Apfell (macOS).
Checkmarx flagged solid281 VS Code extension. It mimics Solidity but drops ScreenConnect or Python shells.
Remove suspect packages now. Rotate all tokens. Check workflows and lockfiles for changes.
FAQ
npm supply chain worm stealing creds and targeting AI tools. 19 packages identified by Socket.
claud-code, crypto-locale, [email protected], and 17 more.Â
McpInject runs fake servers. Prompt injection grabs SSH/AWS keys via tools.
48+ hours delay with jitter. Then full propagation and exfil.
buildrunner-dev (Pulsar RAT), eslint-verify-plugin (Poseidon/Apfell), solid281 VS Code extension.
Read our disclosure page to find out how can you help VPNCentral sustain the editorial team Read more
Improve this guide
User forum
0 messages