New Sandworm_Mode supply chain attack hits global NPM ecosystem
Introduction: A new wave of supply chain attacks is shaking up the open-source ecosystem
Supply chain attacks have become one of the most sophisticated and devastating forms of cyber compromise, and a new incident recently confirmed by security researchers has exposed an extremely advanced campaign associated with the APT group known as Sandworm, a threat actor linked to the Russian Federation's attack infrastructure. The new variant of this type of attack, called Sandworm_Mode, targeted the NPM ecosystem with unprecedented precision and level of infiltration, affecting packages used by developers around the world. This attack demonstrates once again how vulnerable modern systems can be when software supply chains are exploited by manipulating dependencies, developer accounts, or injecting malicious code into seemingly legitimate packages.
The Origin of the Sandworm_Mode Attack: A Continuation of a Dangerous History
Sandworm is an APT group well-known to the international cybersecurity community for large-scale sabotage operations. Over the past decade, it has been linked to operations such as attacks on Ukrainian energy grids, malware distribution operations such as NotPetya, and persistent espionage campaigns. The new variant, called Sandworm_Mode, marks an important strategic shift: a focus on infiltrating global development systems by contaminating the NPM ecosystem, a critical point in the modern software development chain. Thus, the attack does not target just a single product or organization, but potentially millions of applications and services that rely on NPM modules, from enterprise platforms to mobile apps and services. cloud distributed.
The infection mechanism: how the NPM ecosystem was compromised
Technical analysis of the attack shows that Sandworm_Mode actors managed to compromise several NPM packages through complex techniques that include taking over developer accounts, injecting hidden code into essential files, and using post-installation scripts to exfiltrate data. The affected packages introduced a malicious module capable of collecting access tokens, environment variables, SSH credentials, or sensitive configuration files, transmitting them to command and control (C2) servers under the attackers’ control. Through this method, the attackers not only targeted end users, but also gained access to continuous development (CI/CD) infrastructures, internal servers, and critical production accounts, multiplying the impact of the attack globally.
Intrusion vectors used in the attack
Researchers have identified the following techniques used by Sandworm_Mode to infiltrate the software supply chain:
- Taking over developer accounts through credential stuffing or targeted phishing
- Uploading new, corrupted versions of legitimate packages
- Injecting malicious code into JS files used by critical dependencies
- Using postinstall scripts for standalone execution after installation
- Advanced obfuscation to avoid static or dynamic detection
The actors demonstrated a deep understanding of developer workflows, adapting their techniques to remain undetected for as long as possible, thus increasing the overall impact of the campaign.
Global impact and massive risks on software chains
The NPM ecosystem is one of the most widely used package management systems in the world, powering millions of JavaScript, Node.js projects, and distributed services. cloud. That is why an attack like Sandworm_Mode has the potential to compromise entire chains of dependencies, affecting applications used by organizations in banking, energy, telecom, e-commerce or critical infrastructure. When an NPM package with thousands or millions of downloads is contaminated, the attack vector quickly propagates to projects that are not even aware of the indirect dependencies they use. This makes supply chain attacks a major risk in today's cybersecurity landscape, with the ability to paralyze essential services, compromise sensitive data or facilitate subsequent ransomware attacks.
Sandworm_Mode: what it means and why it's different
The name Sandworm_Mode reflects a new operational phase of the APT group, focused on deep infiltration of global software ecosystems. In this campaign, the attackers implemented an advanced persistence module capable of changing the behavior of packets and self-updating, avoiding detection and allowing expansion into target networks. This operational mode includes stealth techniques such as dynamic data encryption, exfiltration through spoofed HTTP channels, and code bases that adapt to the behavior of the environment in which they are executed. The major difference from previous attacks is the modularity of the malicious code, which allows attackers to download and run new malicious components depending on the victim profile and the level of access obtained, which turns each infection into a personalized operation.
Identifying compromise: technical signals and infiltration indicators
Security experts have published a series of indicators of compromise (IOCs) associated with the Sandworm_Mode campaign that can help organizations identify potential infections in their infrastructure. These include C2 IP addresses, malicious file hashes, obfuscation patterns, and suspicious behaviors such as the automatic execution of unusual scripts when installing NPM packages. Among the most critical signals are unauthorized access to CI/CD servers, unjustified extraction of environment variables, and outbound connections to unknown domains. Cisco Talos, Checkmarx, and other research teams have documented these IOCs and provided patches and workarounds to mitigate the risks.
Recommended measures for developers and organizations
To mitigate the risks associated with such supply chain attacks, developers and companies should implement a series of essential protection measures. The first step is to audit all dependencies used, including transitive ones, to identify possible compromised versions. It is also crucial to enable multi-factor authentication for developer accounts, as well as implement strict access policies to build systems and CI/CD infrastructures. Organizations are encouraged to use static and dynamic code analysis systems, security scanning tools integrated into pipelines, and solutions for monitoring the integrity of installed packages. Every update should be verified, and dependencies should be minimized where possible.
Essential recommendations
- Enabling MFA for NPM and Git accounts
- Installing a private package registry for sensitive projects
- Using digital signatures to validate packages
- Reviewing recent versions of critical dependencies
- Implementing an alert system for unusual behavior in the pipeline
These measures do not guarantee the complete elimination of risks, but they significantly reduce the vulnerable surface and increase the chances of early detection of a compromise.
Impact on global security: what Sandworm_Mode means for 2026
The Sandworm_Mode event marks a critical moment in the evolution of global cybersecurity, illustrating how fragile the global software ecosystem is in the face of APT attacks focused on supply chains. As companies digitize their processes and dependencies become increasingly complex, such attacks will continue to emerge and evolve. The attack demonstrates the urgent need to adopt stricter standards for validating open-source packages and securing development environments, as well as the importance of international collaboration between technology providers, security companies and developer communities.
Conclusion: a global warning for the entire technological ecosystem
The Sandworm_Mode incident is a wake-up call for all organizations that rely on open-source ecosystems and NPM packages for software development. It shows that advanced adversaries are willing to invest massive resources to infiltrate critical infrastructures and compromise software supply chains on a global scale. In 2026, cybersecurity must become an absolute priority, and proactive measures, code review automation, and the integration of DevSecOps practices are no longer just recommendations, but fundamental requirements for any company that wants to stay protected in an increasingly dangerous digital landscape.
You have certainly understood what is new in cybersecurity in 2026. If you are interested in deepening your knowledge in the field, we invite you to explore our range of courses structured by roles and categories in CYBERSECURITY HUBWhether you're just starting out or want to brush up on your skills, we have a course for you.
