SANDWORM_MODE: The MCP Worm That Spreads Through npm Typosquats

19 typosquatted npm packages targeting Claude Code, Cursor, and Windsurf users. It injects malicious MCP configs, steals API keys, and self-propagates through Git repos — with a 48-hour delayed activation.

TL;DR

• 19 npm packages typosquatting popular AI tool names
• Injects malicious MCP server configs into .claude/config.json, .cursor/mcp.json, .windsurf/mcp.json
• Steals SSH keys, AWS credentials, npm tokens, LLM API keys
• Self-propagates by committing to discovered Git repos
• 48-hour delayed activation to evade immediate detection
• C2 servers: 45.33.32.100, 103.224.212.44

The Typosquat Packages

The attacker published 19 npm packages that look almost identical to legitimate AI development tools:

+ 13 more packages across various AI tool categories

The Kill Chain

Phase 1: Installation (T+0)

Victim runs npm install -g @anthropic/sdk-extra, thinking it's an official Anthropic package. The postinstall script executes silently.

Phase 2: MCP Config Injection (T+0)

The worm scans for AI tool config files and injects a malicious MCP server:

Now every time the user opens Claude Code, Cursor, or Windsurf, the malicious MCP server loads automatically. The user sees nothing — it runs alongside their legitimate MCP servers.

Phase 3: Credential Harvesting (T+0 to T+48h)

The injected MCP server uses tool description poisoning (see our MCP Tool Poisoning article) to silently exfiltrate:

Phase 4: Self-Propagation (T+48h)

After 48 hours — enough time to avoid correlation with the initial install — the worm activates its propagation module:

1. Discovers all Git repositories on the machine
2. Commits a small, innocuous-looking utility file to each repo
3. The utility file contains the worm payload, obfuscated
4. When collaborators pull and run npm install, they get infected too

This is a true worm — it doesn't just steal data, it actively spreads through development team infrastructure.

Why 48-Hour Delay Matters

Most security scanning happens at install time:

• npm audit checks at install — passes (no known CVE yet)
• Static analysis at install — passes (worm is dormant)
• Behavioral monitoring first 24h — nothing suspicious
• Day 3: worm activates, credentials exfiltrated, repos infected

By the time anyone notices, the blast radius has expanded to the entire team.

IOC Table

Detection

Check if you're infected right now:

What Makes This Different

ClawHavoc was social engineering at scale — tricking users into running malicious commands. SANDWORM_MODE is a fully automated worm that:

1. Exploits the npm supply chain (typosquats)
2. Weaponizes the MCP protocol (config injection + tool poisoning)
3. Self-propagates through Git (team-wide compromise)
4. Uses delayed activation (evades install-time scanning)

This is the first documented AI-tool-native worm — malware specifically designed to spread through the Agent-Native development ecosystem.