Malware is targeting AI tools in software development environments

Sandworm_Mode is a self-propagating supply-chain worm discovered in February that targets AI coding assistants and developer automation by spreading through code repositories and dependencies to harvest credentials, API keys (including keys for major LLM providers), CI/CD secrets, and cloud access. The worm blends malicious activity into noisy AI development workflows, uses multi-day pacing to evade detection, and can destructively wipe environments if unable to spread; CrowdStrike observed related malicious packages but attribution and full intent remain unclear.