Nineteen malicious packages on the npm registry are spreading a worm known as SANDWORM_MODE. These packages steal crypto keys, CI secrets, API tokens, and AI API keys. The theft occurs through MCP injection.
Security researchers have identified 19 malicious npm packages that are actively harvesting sensitive information from developers' systems. According to reports, these packages propagate a worm called SANDWORM_MODE, which targets crypto keys, continuous integration (CI) secrets, API tokens, and AI API keys.
The malicious software employs MCP injection as its primary method to extract and exfiltrate this data. npm, the popular package manager for JavaScript and Node.js, serves as the distribution platform for these threats, potentially compromising developers who install the affected packages unknowingly.
This incident highlights ongoing risks in open-source software ecosystems, where supply chain attacks can lead to widespread data breaches. No specific details on the exact names of the 19 packages or the total number of affected users were provided in the available information.
Developers are advised to review their dependencies and use tools to scan for vulnerabilities in npm packages to mitigate such risks.