SANDWORM_MODE npm Worm Now Injects Malicious MCP Servers into AI Coding Agents

blackorbird

Feb 21, 2026 · Updated Apr 25, 2026

Socket's threat research uncovered SANDWORM_MODE, an active npm worm that targets AI coding assistants via MCP server injection. Installing one of 19 malicious typosquatted packages gives attackers a foothold that feeds hostile instructions to tools like Claude Code and Cursor.

SANDWORM_MODE is an active npm supply chain worm tracked by Socket's threat research team across at least 19 malicious packages under two npm aliases. When a developer installs one, the package steals credentials, injects a hidden malicious MCP server into their home directory, and poisons GitHub Actions workflows - propagating through any repos the developer can access.

The MCP injection is the new attack surface. The malicious server registers itself with AI coding agents and can push hostile prompt injections into tools like Claude Code or Cursor, manipulating the agent's behavior during sessions. Packages impersonate popular tools via typosquatting (e.g., suport-color for supports-color), making them easy to install by mistake.

Socket has petitioned npm to remove the packages and linked publisher aliases. Check your package.json dependencies against the Indicators of Compromise list in Socket's report.

View the full update on socket.dev

blackorbird

@blackorbirdFeb 21

MCP Server Injection The payload exports a dedicated McpInject module that targets AI coding assistants. It first generates a randomized developer-sounding name from word pools (e.g., dev-utils, node-analyzer) and creates a hidden directory in the user’s home (e.g., ~/.dev-utils/), then writes a malicious MCP server into it. ref: SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains https://t.co/nkLEl5jO47

View on X

Every HeadsUpAI update is written based on its original source and reviewed before it's published. Read our editorial standards →

Keep reading

Cloudflare MCP Server Covers Full API in Two Tools and 1,000 Tokens

Cloudflare launched a new MCP server that covers its 2,500-endpoint API in two tools and ~1,000 tokens. Code Mode lets agents write code to discover and call APIs instead of loading every tool description upfront, cutting token overhead by 99.9%.

CopilotKit🪁Apr 13

CopilotKit Launches MCP Server to Equip Coding Agents With Framework Expertise

CopilotKit released a dedicated Model Context Protocol server that provides AI coding agents with direct access to its APIs and best practices. By connecting tools like Cursor and Claude Code to this server, developers can eliminate hallucinations and ensure AI-generated code follows official implementation patterns.

Notion Workers Run on Vercel Sandbox for Secure Agent Code Execution

VercelMar 15

Notion Workers Run on Vercel Sandbox for Secure Agent Code Execution

Notion Workers, Notion's new feature for extending AI agents with custom code, runs on Vercel Sandbox. Each Worker executes in an isolated Firecracker microVM with credential injection and dynamic network policies, giving enterprises safe untrusted code execution at scale.

OpenAI Builds Custom Windows Sandbox to Secure Codex Agentic Workflows

OpenAIMay 14

OpenAI Builds Custom Windows Sandbox to Secure Codex Agentic Workflows

OpenAI developed a custom security sandbox for Codex on Windows to enable autonomous command execution without compromising system safety. The new architecture uses dedicated local users and firewall rules to strictly control file access and network traffic for coding agents.