# SANDWORM_MODE: 19 npm typosquats with self-spreading worm + AI toolchain poisoning > Socket disclosed a Shai-Hulud-style self-propagating worm spread across at least 19 typosquatted npm packages from accounts `official334` and `javaorg`. It harvests CI secrets and crypto keys, propagates via stolen npm/GitHub tokens, and injects prompt-injection logic into MCP servers used by AI coding assistants. - Published: 2026-02-20 - Severity: critical - Kind: Typosquat - A package that never had a legitimate version, named to be mistaken for a real one - a misspelling, a lookalike scope, or an impersonated vendor SDK. - Ecosystems: npm - Scope: 19 packages, 19 compromised versions - Tags: worm, typosquat, credential-theft, prompt-injection, ci-cd-compromise - Also known as: SANDWORM_MODE, Shai-Hulud variant - Detected by: Socket - Incident ID: npm-2026-02-20-sandworm-mode ## Affected packages (19) Only the exact versions listed were named by the source advisories. Other versions are not implicated. | Package | Ecosystem | Compromised versions | |---|---|---| | [claud-code](https://dependencywatch.io/package/npm/claud-code) | npm | 0.2.1 | | [cloude](https://dependencywatch.io/package/npm/cloude) | npm | 0.3.0 | | [cloude-code](https://dependencywatch.io/package/npm/cloude-code) | npm | 0.2.1 | | [crypto-locale](https://dependencywatch.io/package/npm/crypto-locale) | npm | 1.0.0 | | [crypto-reader-info](https://dependencywatch.io/package/npm/crypto-reader-info) | npm | 1.0.0 | | [detect-cache](https://dependencywatch.io/package/npm/detect-cache) | npm | 1.0.0 | | [format-defaults](https://dependencywatch.io/package/npm/format-defaults) | npm | 1.0.0 | | [hardhta](https://dependencywatch.io/package/npm/hardhta) | npm | 1.0.0 | | [locale-loader-pro](https://dependencywatch.io/package/npm/locale-loader-pro) | npm | 1.0.0 | | [naniod](https://dependencywatch.io/package/npm/naniod) | npm | 1.0.0 | | [node-native-bridge](https://dependencywatch.io/package/npm/node-native-bridge) | npm | 1.0.0 | | [opencraw](https://dependencywatch.io/package/npm/opencraw) | npm | 2026.2.17 | | [parse-compat](https://dependencywatch.io/package/npm/parse-compat) | npm | 1.0.0 | | [rimarf](https://dependencywatch.io/package/npm/rimarf) | npm | 1.0.0 | | [scan-store](https://dependencywatch.io/package/npm/scan-store) | npm | 1.0.0 | | [secp256](https://dependencywatch.io/package/npm/secp256) | npm | 1.0.0 | | [suport-color](https://dependencywatch.io/package/npm/suport-color) | npm | 1.0.1 | | [veim](https://dependencywatch.io/package/npm/veim) | npm | 2.46.2 | | [yarsg](https://dependencywatch.io/package/npm/yarsg) | npm | 18.0.1 | ## What happened Socket called this campaign **SANDWORM_MODE** after a marker string embedded in the worm payload. It is a Shai-Hulud-style self-propagating attack - same shape as the September 2025 original - refined to target the AI-developer-tools surface specifically. Nineteen typosquatted packages were published from two npm accounts: `official334` and `javaorg`. The package names cluster around AI coding tools and their adjacent typo space (`claud-code`, `cloude-code`, `cloude`, `opencraw`). On install, the payload harvests CI secrets, npm and GitHub tokens, and any crypto keys it can find; then it uses the stolen tokens to publish further malicious versions of any package the maintainer can reach. The novel piece is the MCP-server injection: the worm modifies `mcp.json` and equivalent config files on disk to attach prompt-injection logic that targets downstream AI coding assistants. The intent is to weaponise the assistant's own context - when a developer asks Claude Code, Cursor, or similar to "look at the issue and fix it," the poisoned MCP server returns content engineered to make the assistant produce malicious follow-on actions. Defenders should audit dev environments for any reference to `ci-quality/code-quality-check@v1` (a planted GitHub Actions workflow used for propagation) and block egress to the `*.workers.dev` exfil endpoints listed in the Socket post. ## Impact - CI/CD secrets, npm tokens, GitHub tokens and crypto keys exfiltrated - AI coding tools (Claude Code and OpenClaw impersonations) targeted for downstream developer compromise - Worm propagation through stolen publish credentials ## What to do 1. Remove any of the 19 listed packages; rotate npm/GitHub/cloud tokens 2. Audit dev environments for `ci-quality/code-quality-check@v1` references 3. Block egress to *.workers.dev exfil endpoints listed in the Socket post ## Check your own dependencies - Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json The scan runs entirely in the browser; lockfile contents are never uploaded. ## References - [Socket: SANDWORM_MODE npm worm + AI toolchain poisoning](https://socket.dev/blog/sandworm-mode-npm-worm-ai-toolchain-poisoning) - Socket --- Canonical page: https://dependencywatch.io/incident/npm-2026-02-20-sandworm-mode Markdown version: https://dependencywatch.io/incident/npm-2026-02-20-sandworm-mode.md Site index for agents: https://dependencywatch.io/llms.txt DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).