A Sneaky Hacking Tool Targeting AI Infrastructure Is Lurking in Victims’ Blind Spots

CrowdStrike researchers have identified an active worm targeting AI software development supply chains that performs reconnaissance, harvests access tokens and cryptographic keys (including npm tokens), escalates privileges, and can deploy a destructive "death switch." The malware blends into legitimate AI automation workflows and uses delayed execution to evade detection, highlighting emerging supply-chain risks as AI toolchains become central to development.