SANDWORM_MODE (yarsg / format-defaults)

SafeDep’s step-by-step analysis of the SANDWORM_MODE npm campaign:
malicious packages yarsg and format-defaults with a decoded
multi-stage payload. Named campaign, not a one-off typosquat.

Mapped techniques

T0109 Publish malicious artifact
T0159 Malicious artifact execution

supply-chain named loader campaign

T0109 · Resource Development · Publish malicious artifact

yarsg and format-defaults.

T0159 · Execution · Malicious artifact execution

Multi-stage SANDWORM_MODE loader.

Sources

https://safedep.io/npm-sandworm-mode-supply-chain-attack
https://socket.dev/blog/sandworm-mode-npm-worm-ai-toolchain-poisoning