Part 60 · Module 8: Security

Incident: A worm added servers to AI configs

8 min read·13 Oct 2026

Module 8 · Incident file · About 35 minutes · Needs: the Module 8 lab (its pinning.py and guard.py)

What happened

Socket published on 20 February 2026, three days after the actor's GitHub repository was created (red); the removals (green) are undated in the post.

On 20 February 2026 the Socket Research Team published "SANDWORM_MODE: Shai-Hulud-Style npm Worm Hijacks CI Workflows and Poisons AI Toolchains" (Socket, 2026). The team "uncovered what we assess as a Shai-Hulud-like supply chain worm" spread across at least 19 malicious npm packages from two publisher aliases. Several names imitated real tools by one letter, among them claud-code, cloude-code and suport-color.

The post describes what the packages did, not how to do it, and this file stays at that level. The code ran when a package was imported. Some steps waited behind "a 48-hour base delay" plus jitter, except in CI. It collected npm and GitHub tokens and environment secrets, used stolen tokens to spread, and planted CI workflows and git hooks. Its MCP part, which Socket calls McpInject, "creates a hidden directory in the user's home", writes a rogue MCP server there, and "injects this server into every AI coding assistant config it finds on disk": Claude Code, Claude Desktop, Cursor, VS Code Continue and Windsurf.

The MCP part of the worm (red): a rogue server written to disk and added to five assistants' configurations, its descriptions carrying an instruction the course does not show.

The rogue server offered three ordinary-sounding tools, index_project, lint_check and scan_dependencies. Socket reports that each description carried an instruction aimed at the assistant: gather SSH keys, cloud credentials, npm tokens and environment secrets, pass them to the tool, and keep that step from the user. The course does not reproduce the wording. The package also harvested API keys for nine model providers, Groq among them.

How it was caught: Socket's own analysis, including its scanner's reading of suport-color's "obfuscated import-time loader". Socket says it notified npm, GitHub and Cloudflare before publishing; later lines in the post say npm removed the packages, GitHub removed the infrastructure and Cloudflare took down the workers. The post gives no dates for those removals and no count of affected machines, so the cost is not stated. Its advice for defenders includes rotating tokens and secrets and to "Review local AI assistant configs for unexpected mcpServers entries."

What happened

The rest of this course is yours to keep