Sandworm_Mode is an example of malware that exploits trusted AI tools and workflows to make malicious activity virtually indistinguishable from normal.

A new type of malware can worm deep into AI coding systems to steal data and logins—and can flip a “death switch” to destroy files and keep out real users.

SANDWORM_MODE represents a sophisticated multi-stage npm supply chain worm discovered in early 2026....