CrowdStrike warns of malware targeting AI coding tools

CrowdStrike has published research on malware designed to exploit AI coding assistants, describing it as a new type of software supply chain attack in AI-driven development environments.

The malware, known as SANDWORM_MODE, is a multi-stage npm supply chain worm that targets AI-augmented development workflows rather than only conventional package distribution or build systems. The campaign shows how attackers can use routine actions inside development pipelines to blend malicious behaviour into normal engineering activity.

The attack chain begins with an obfuscated loader triggered when a package is imported. That initial stage uses several layers of encoding and runtime unpacking, which can help the malware evade static analysis tools that scan packages when they are published.

Once active, the malware fingerprints the runtime environment to distinguish between a developer workstation and a continuous integration runner. It then harvests data including .npmrc tokens, environment variables containing keys, secrets, tokens or passwords, and cryptocurrency wallet keys.

The worm delays part of its activity on developer machines by 48 to 96 hours, while moving immediately in CI environments where systems may exist only briefly. That gap complicates detection because the initial package import and later malicious actions may appear in separate telemetry windows.

How it spreads

SANDWORM_MODE uses several propagation methods tied to compromised credentials. With stolen npm tokens, it can identify the affected publisher account, enumerate packages under that identity, insert malicious code and republish infected versions.

With GitHub API tokens, the malware can enumerate accessible repositories, inject a dependency, commit changes or open a pull request, and add a workflow designed to execute in the context of the base repository. If API access is unavailable, the worm can fall back to SSH authentication to clone repositories, alter them and push changes directly.

The malware also establishes persistence on developer systems by writing malicious pre-commit and pre-push hooks into global Git templates. After that, every new repository created or cloned on the compromised machine can automatically inherit the infected hooks.

AI toolchain focus

A central feature of the malware is its attempt to compromise AI assistants and large language model toolchains. It deploys a rogue MCP server in a hidden directory and inserts configuration entries into tools including Claude Desktop, Cursor, Visual Studio Code and Windsurf so the server appears to be a trusted tool provider.

According to the research, the rogue server then instructs AI assistants to read and exfiltrate SSH keys, AWS credentials, npm tokens and environment secrets through the tool interface. Separately, the malware harvests API keys for nine AI model providers from environment variables and .env files.

This aspect of the attack illustrates a broader shift in supply chain risk, because the target is not only code repositories or packages but also the trust relationships inside AI-assisted development workflows. The report describes this as a form of "living off the AI toolchain," echoing the long-established tactic of abusing legitimate system tools to hide malicious activity.

Detection limits

CrowdStrike engineers carried out a gap analysis after disclosure of the campaign and investigated 14 behaviours linked to the malware. Of those, nine produced some detectable signal, while only two met the standard for customer-visible alerting.

The company deployed 65% of the detection candidates it developed. The remainder were ruled infeasible because the malicious actions looked too similar to normal developer and CI automation. In active development environments, operations such as npm publish, repository pushes, pull requests and credential handling can occur frequently as part of legitimate work.

That overlap is one of the central problems highlighted by the research. Actions such as command execution, file writes, child process creation and API interaction are already expected behaviour for many AI coding assistants, making it difficult to separate hostile use from normal activity using deterministic rules alone.

Some of the malware's most damaging actions also resemble legitimate workflows. Its destructive fallback routine, which wipes writable user files if both propagation and exfiltration fail, overlaps with some secure deletion and cleanup operations used in development and build environments.

The report also says the malware targets password manager command-line tools and local SQLite stores, including Apple Notes, Messages, Joplin and clipboard history, before sending stolen data to attacker infrastructure. It can also mirror exfiltrated data to attacker-controlled private GitHub repositories and fall back to DNS tunnelling if primary channels are blocked.

By mapping the campaign against the six common components of an AI-driven CI/CD pipeline, CrowdStrike concluded that every layer of that workflow can act as both a dependency and a possible attack surface. Indicators of attack derived from the investigation are already being used to protect customers.

"SANDWORM_MODE is not a one-off campaign as much as it is a proof of concept for an emerging attack class," CrowdStrike said.