TL;DR

["Supply chain attack using npm packages steals CI/CD secrets, API tokens, and crypto keys. At least 19 npm packages are part of the attack wave codenamed 'SANDWORM_MODE'. Operators must review package dependencies immediately to mitigate risks."]

What happened

['Researchers discovered a supply chain worm campaign using malicious npm packages to harvest CI/CD secrets, API tokens, and cryptocurrency keys.', 'The campaign is codenamed SANDWORM_MODE by Socket Security.', 'At least 19 different npm packages are involved in the attack wave.']

Why it matters for ops

['Malicious packages can compromise build integrity and steal sensitive credentials.', 'Supply chain attacks pose significant risks to software delivery processes.']

Mitigation

  • Immediately review and update all package dependencies in use.
  • Enable strict dependency pinning and use version ranges carefully.
  • Ensure robust security practices in CI/CD pipelines including secret scanning tools.

Action items

  • Audit npm packages used across the organization
  • Implement or enforce security policies for third-party software integration

Detection IOCs

  • Identify npm packages with unusual names or activity patterns
  • Monitor for unauthorized access attempts to secrets managers like AWS Secrets Manager, Azure Key Vault
  • Look for unexpected network connections from CI/CD servers to external IP addresses

Source link

https://thehackernews.com/2026/02/malicious-npm-packages-harvest-crypto.html