A Self-Spreading Worm Disguises Itself as AI Coding Work

A self-spreading worm is operating inside AI coding pipelines, running reconnaissance, harvesting npm tokens and LLM API keys, escalating privileges, and carrying a destructive "death switch" that can wipe files or lock legitimate users out. The campaign, which CrowdStrike has named SANDWORM_MODE, is, by the security firm's account, the first in-the-wild worm it has seen built specifically to ride the same rails as the AI coding tools defenders now trust.

CrowdStrike's Adam Meyers, who runs the firm's counter-adversary work, told WIRED that the worm's signature is its camouflage. "It's like a needle in a haystack, except this is a needle in a needle stack," he said. The inversion is the story. The harder problem is not finding a rare attack but finding an attack inside an environment where the new normal looks like the attack itself.

According to CrowdStrike's research blog, the first stage is an obfuscated loader, packed with Base64, zlib, XOR, and eval to stay hidden from static scanners. Stage one is a fast, narrow harvest, a 48- to 96-hour time bomb that pulls access tokens, cryptographic keys, and server credentials, especially the npm tokens that let a developer publish packages to the public registry that millions of projects pull in as dependencies. Stage two is the full capability suite: propagation through stolen tokens, injection of malicious code into GitHub pull requests via the pull_request_target workflow, planting of rogue MCP servers inside Claude Desktop, Cursor, VS Code, and Windsurf, and harvesting of LLM API keys across nine providers. If anything interrupts the chain, the worm falls back to a destructive shred -uvz -n 1 command that can erase files in place.

The 19 malicious packages at the heart of the disclosure were first identified by the supply-chain security firm Socket.dev in February 2026, across two publisher aliases. CrowdStrike's research blog walks through how each stage builds on the last and why the time delays matter: they break the behavioral correlation that defenders normally use to chain reconnaissance, credential theft, and escalation into a single incident.

The blind spot the worm exposes is structural. Behavioral detection works when malicious activity looks different from legitimate work. In an AI coding pipeline, the new legitimate work is exactly what this worm is doing: calling out to package registries, opening pull requests, spinning up local servers, and pinging LLM APIs. CrowdStrike's own detection content for SANDWORM_MODE was built from a gap analysis of the chain. Defenders had to author rules after seeing the worm rather than catching it on behavior alone.

There is also what CrowdStrike does not yet know. The firm has not attributed SANDWORM_MODE to a specific actor, and the resemblance it has flagged to TeamPCP (which CrowdStrike tracks as "Altered Spider") and to North Korean groups that have targeted the AI software supply chain is a pattern match, not an attribution. That uncertainty cuts both ways: the worm is real and operating, but the case for a new, recurring attack class rests on this one incident being representative.

Meyers' "needle in a needle stack" line is the cleanest articulation of the shift: in a pipeline where the bot is now part of the workflow, the attacker does not need to hide. It just needs to look like work.