SShortSingh.
TopTechnologyAI & MLStartupsProgrammingScienceBusinessFinanceCrypto & Web3World
Back to feed
Programming

SANDWORM_MODE: New npm Worm Targets AI Coding Tools and CI/CD Pipelines

0
·1 views

A sophisticated npm supply chain worm called SANDWORM_MODE was discovered in early 2026, designed to specifically target AI-augmented development environments such as GitHub Copilot and Cursor. The malware operates in three stages, beginning with an obfuscated loader that evades static analysis before moving to credential harvesting and full payload deployment. It exploits the integration between AI coding assistants and CI/CD pipelines to steal sensitive data including cryptocurrency keys and npm tokens. The worm can also register rogue MCP servers to compromise AI assistants, and includes a destructive failsafe that deletes user files if data exfiltration is unsuccessful. Security researchers are responding by developing detection methods focused on identifying unusual Node.js process behaviors and process ancestry patterns.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

Log in to join the discussion and vote.

Log in

Related stories

0
ProgrammingDEV Community ·

Claude Code's SKILL.md format explained: how to write skills that trigger correctly

Claude Code skills are reusable, structured instruction sets designed to replace repetitive procedures users paste into chat sessions. Unlike entries in CLAUDE.md, a skill's body only loads into context when the skill is actually invoked, keeping overhead minimal. Each skill lives in a dedicated directory with a SKILL.md file containing frontmatter fields — most importantly a description, which Claude reads in every session to decide when to activate the skill. The description acts as the trigger mechanism, so it should mirror the natural phrases a user might say, while the body holds the full step-by-step procedure. Optional frontmatter settings like disable-model-invocation and allowed-tools give developers control over whether a skill fires automatically or only on explicit user command.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Pitting Two AI Models Against Each Other Catches Errors Better Than Self-Checking

A developer discovered that asking one AI model to actively refute another's reasoning caught errors far more reliably than re-prompting the same model repeatedly. The core problem is that a single model carries consistent blind spots, so running it multiple times only reinforces the same flawed reasoning with false confidence. The key insight was instructing the second model to find where logic breaks — not to review or agree — since models are built to be agreeable by default. The author automated this cross-model check by triggering it on signs of frustration, such as repeated complaints or stalled sessions, rather than relying on personal judgement. While this approach still allows one wrong answer through before the check fires, it significantly shortens the cycle of compounding errors compared to single-model iteration.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

Init User Engine brings gamified user accounts to WordPress without jQuery

Init User Engine is a new lightweight WordPress plugin that replaces the platform's default login and profile system with a gamified user experience. It introduces features such as EXP and level progression, a dual-currency wallet, daily check-ins, VIP membership, referral tracking, and a built-in inbox. The entire frontend is rendered client-side using Vanilla JavaScript communicating with a dedicated REST API, avoiding the performance overhead common in traditional WordPress membership plugins. A single shortcode deploys the full account dashboard, including avatar management, login and registration modals, and an admin notification panel. The plugin is designed as the core user system within the broader Init Plugin Suite, prioritizing performance and extensibility through a comprehensive set of action and filter hooks.

0 comments Read more at DEV Community
0
ProgrammingDEV Community ·

What Are Vector Databases? Key Concepts in Embeddings and Similarity Search

Vector databases store data as numerical vectors that represent the features of objects, enabling efficient similarity search across large datasets. Unlike traditional databases, they represent a fundamental shift in how data is stored and queried, making them especially valuable for AI-driven applications. Embeddings — lists of numbers capturing the meaning or characteristics of objects like words, images, or songs — are central to how these databases function. By calculating distances between vectors, the system identifies the most similar items, a technique used in recommendation engines, image search, and natural language processing. Tools like the Faiss library help developers implement optimized similarity search, and real-world applications range from music and movie recommendations to content discovery platforms.

0 comments Read more at DEV Community
SANDWORM_MODE: New npm Worm Targets AI Coding Tools and CI/CD Pipelines · ShortSingh