coding-agent-audit 0.7.0__tar.gz → 0.8.0__tar.gz

{coding_agent_audit-0.7.0 → coding_agent_audit-0.8.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.7.0
+Version: 0.8.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -120,6 +120,12 @@ Cursor Marketplace Claude Code trojan:
   the `.claude/router_runtime.js` / `.claude/setup.mjs` / `.vscode/setup.mjs`
   dropper files it plants in a project (checked in the current directory
   and any `--project` path)
+- **SANDWORM_MODE** (the npm worm that registers a rogue local MCP server
+  with Claude Code, Cursor, Windsurf and Continue, added in v0.8.0): the
+  hidden `~/.dev-utils/` directory it installs, and any MCP server entry
+  in your Claude Code / Claude Desktop / Cursor / Windsurf config that
+  points at that directory or uses one of its giveaway tool names
+  (`index_project`, `lint_check`, `scan_dependencies`)
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:

{coding_agent_audit-0.7.0 → coding_agent_audit-0.8.0}/README.md

@@ -99,6 +99,12 @@ Cursor Marketplace Claude Code trojan:
   the `.claude/router_runtime.js` / `.claude/setup.mjs` / `.vscode/setup.mjs`
   dropper files it plants in a project (checked in the current directory
   and any `--project` path)
+- **SANDWORM_MODE** (the npm worm that registers a rogue local MCP server
+  with Claude Code, Cursor, Windsurf and Continue, added in v0.8.0): the
+  hidden `~/.dev-utils/` directory it installs, and any MCP server entry
+  in your Claude Code / Claude Desktop / Cursor / Windsurf config that
+  points at that directory or uses one of its giveaway tool names
+  (`index_project`, `lint_check`, `scan_dependencies`)
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:

{coding_agent_audit-0.7.0 → coding_agent_audit-0.8.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "coding-agent-audit"
-version = "0.7.0"
+version = "0.8.0"
 description = "Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server."
 readme = "README.md"
 requires-python = ">=3.9"

{coding_agent_audit-0.7.0 → coding_agent_audit-0.8.0}/src/agentaudit/__init__.py

@@ -3,4 +3,4 @@ for AI coding assistants (Claude Code, Cursor, Windsurf, VS Code forks, MCP
 servers).
 """
 
-__version__ = "0.7.0"
+__version__ = "0.8.0"

{coding_agent_audit-0.7.0 → coding_agent_audit-0.8.0}/src/agentaudit/checks.py

@@ -7,6 +7,7 @@ module is unit-testable without touching a real home directory.
 from __future__ import annotations
 
 import hashlib
+import json
 import os
 import platform
 import re
@@ -14,12 +15,14 @@ import subprocess
 from pathlib import Path
 from typing import Iterable, Optional
 
+from .configscan import default_config_paths
 from .findings import Finding
 from .iocs import INCIDENTS
 
 _IOC = INCIDENTS["openvsx-claude-code-2026-10"]
 _EMBRACE = INCIDENTS["embrace-embedded-browser-2026-10"]
 _SHAI_HULUD = INCIDENTS["mini-shai-hulud-gh-token-monitor-2026"]
+_SANDWORM = INCIDENTS["sandworm-mode-npm-2026-11"]
 
 
 def check_ssh_authorized_keys(home: Path) -> list[Finding]:
@@ -491,6 +494,84 @@ def check_shai_hulud_project_markers(project_dirs: Iterable[Optional[Path]]) ->
     return findings
 
 
+def check_sandworm_mode_dev_utils(home: Path) -> list[Finding]:
+    """Flag the hidden ~/.dev-utils/ directory the SANDWORM_MODE npm worm
+    uses to host its rogue local MCP server."""
+    path = home / _SANDWORM["hidden_dir"]
+    if path.is_dir():
+        return [
+            Finding(
+                check_id="sandworm-mode-dev-utils-dir",
+                severity="critical",
+                title="Known SANDWORM_MODE rogue MCP server directory found",
+                detail=(
+                    f"'{path}' exists, matching the hidden rogue MCP "
+                    f"server directory planted by the {_SANDWORM['name']}. "
+                    f"Remove the directory, check your Claude Code / "
+                    f"Cursor / Windsurf / Continue MCP config for a server "
+                    f"registration pointing at it (often named one of "
+                    f"{', '.join(_SANDWORM['rogue_tool_names'])}), and "
+                    f"rotate every SSH key, AWS credential and token on "
+                    f"this machine."
+                ),
+                path=str(path),
+                references=_SANDWORM["references"],
+            )
+        ]
+    return []
+
+
+def check_sandworm_mode_mcp_registration(config_paths: Iterable[Path]) -> list[Finding]:
+    """Flag any MCP server registration (Claude Code, Cursor, Windsurf,
+    Continue) that points at the SANDWORM_MODE rogue server directory or
+    uses one of its giveaway tool names."""
+    findings: list[Finding] = []
+    for path in config_paths:
+        if not path.is_file():
+            continue
+        try:
+            config = json.loads(path.read_text())
+        except (OSError, json.JSONDecodeError):
+            continue
+        if not isinstance(config, dict):
+            continue
+        servers = config.get("mcpServers") or config.get("mcp_servers")
+        if not isinstance(servers, dict):
+            continue
+        for server_name, server_cfg in servers.items():
+            if not isinstance(server_cfg, dict):
+                continue
+            command = str(server_cfg.get("command", ""))
+            args = " ".join(str(a) for a in (server_cfg.get("args") or []))
+            full_cmdline = f"{command} {args}"
+            hit_dir = _SANDWORM["hidden_dir"] in full_cmdline
+            hit_name = server_name in _SANDWORM["rogue_tool_names"]
+            if not (hit_dir or hit_name):
+                continue
+            reason = (
+                f"points at the rogue {_SANDWORM['hidden_dir']} directory"
+                if hit_dir
+                else "uses a known SANDWORM_MODE giveaway tool name"
+            )
+            findings.append(
+                Finding(
+                    check_id="sandworm-mode-mcp-registration",
+                    severity="critical",
+                    title="Known SANDWORM_MODE rogue MCP server registration found",
+                    detail=(
+                        f"MCP server '{server_name}' in '{path}' {reason}, "
+                        f"matching the {_SANDWORM['name']}. Remove this "
+                        f"server entry, delete ~/{_SANDWORM['hidden_dir']}/, "
+                        f"and rotate every SSH key, AWS credential and "
+                        f"token on this machine."
+                    ),
+                    path=str(path),
+                    references=_SANDWORM["references"],
+                )
+            )
+    return findings
+
+
 def run_all_ioc_checks(
     home: Optional[Path] = None, project_dirs: Iterable[Path] = ()
 ) -> list[Finding]:
@@ -508,6 +589,12 @@ def run_all_ioc_checks(
     findings += check_c2_network_indicators(live_process_lines())
     findings += check_linux_cron_persistence(live_crontab_text())
     findings += check_shai_hulud_project_markers([Path.cwd(), *project_dirs])
+    findings += check_sandworm_mode_dev_utils(home)
+    config_paths: dict[str, Path] = {str(p): p for p in default_config_paths(home)}
+    for project_dir in [Path.cwd(), *project_dirs]:
+        for p in default_config_paths(home, project_dir):
+            config_paths[str(p)] = p
+    findings += check_sandworm_mode_mcp_registration(config_paths.values())
     if platform.system() == "Linux":
         findings += check_shai_hulud_systemd_service(home)
     if platform.system() == "Darwin":

{coding_agent_audit-0.7.0 → coding_agent_audit-0.8.0}/src/agentaudit/configscan.py

@@ -245,12 +245,15 @@ def default_config_paths(home: Path, project_dir: Path | None = None) -> list[Pa
         / "Roaming"
         / "Claude"
         / "claude_desktop_config.json",
+        home / ".cursor" / "mcp.json",
+        home / ".codeium" / "windsurf" / "mcp_config.json",
     ]
     if project_dir is not None:
         paths += [
             project_dir / ".claude" / "settings.json",
             project_dir / ".claude" / "settings.local.json",
             project_dir / ".mcp.json",
+            project_dir / ".cursor" / "mcp.json",
         ]
     return paths
 

{coding_agent_audit-0.7.0 → coding_agent_audit-0.8.0}/src/agentaudit/iocs.py

@@ -107,4 +107,29 @@ INCIDENTS = {
             ".vscode/setup.mjs",
         ],
     },
+    "sandworm-mode-npm-2026-11": {
+        "name": "SANDWORM_MODE npm supply-chain worm, rogue MCP server (Nov 2026)",
+        "description": (
+            "A self-propagating npm supply-chain worm (SANDWORM_MODE), "
+            "distributed via 19 typosquatted packages published under the "
+            "'official334' and 'javaorg' npm aliases (e.g. suport-color, a "
+            "typosquat of supports-color). Its install script drops a "
+            "hidden directory, ~/.dev-utils/, containing a rogue local MCP "
+            "server and registers it with Claude Code, Cursor, Windsurf "
+            "and Continue under three innocuous-sounding tool names "
+            "(index_project, lint_check, scan_dependencies) so the AI "
+            "assistant itself ends up invoking it; the server then reads "
+            "SSH keys, AWS credentials and password-manager secrets, "
+            "installs Git-hooks persistence, and propagates by publishing "
+            "further typosquatted packages."
+        ),
+        "references": [
+            "https://socket.dev/blog/sandworm-mode-npm-worm-ai-toolchain-poisoning",
+            "https://www.endorlabs.com/learn/sandworm-mode-dissecting-a-multi-stage-npm-supply-chain-attack",
+            "https://www.securityweek.com/new-sandworm_mode-supply-chain-attack-hits-npm/",
+        ],
+        "hidden_dir": ".dev-utils",
+        "rogue_tool_names": ["index_project", "lint_check", "scan_dependencies"],
+        "typosquat_aliases": ["official334", "javaorg"],
+    },
 }

{coding_agent_audit-0.7.0 → coding_agent_audit-0.8.0}/src/coding_agent_audit.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: coding-agent-audit
-Version: 0.7.0
+Version: 0.8.0
 Summary: Scan your machine for known AI-coding-assistant supply-chain backdoor indicators (Claude Code / Cursor / Windsurf extensions, MCP servers) plus risky hook/permission config patterns. Usable as a CLI or as an MCP server.
 Author-email: StackScribe AI <survivalagent320@gmail.com>
 License: MIT
@@ -120,6 +120,12 @@ Cursor Marketplace Claude Code trojan:
   the `.claude/router_runtime.js` / `.claude/setup.mjs` / `.vscode/setup.mjs`
   dropper files it plants in a project (checked in the current directory
   and any `--project` path)
+- **SANDWORM_MODE** (the npm worm that registers a rogue local MCP server
+  with Claude Code, Cursor, Windsurf and Continue, added in v0.8.0): the
+  hidden `~/.dev-utils/` directory it installs, and any MCP server entry
+  in your Claude Code / Claude Desktop / Cursor / Windsurf config that
+  points at that directory or uses one of its giveaway tool names
+  (`index_project`, `lint_check`, `scan_dependencies`)
 
 **Config heuristics** (`configscan.py`) — pattern-based, always worth a
 second look rather than proof of compromise:

{coding_agent_audit-0.7.0 → coding_agent_audit-0.8.0}/tests/test_checks.py

@@ -1,6 +1,8 @@
 import hashlib
 from pathlib import Path
 
+import json
+
 from agentaudit.checks import (
     check_c2_network_indicators,
     check_embrace_copilot_version,
@@ -9,6 +11,8 @@ from agentaudit.checks import (
     check_linux_cron_persistence,
     check_macos_launch_agent,
     check_marker_files,
+    check_sandworm_mode_dev_utils,
+    check_sandworm_mode_mcp_registration,
     check_shai_hulud_launch_agent,
     check_shai_hulud_project_markers,
     check_shai_hulud_systemd_service,
@@ -23,6 +27,7 @@ from agentaudit.iocs import INCIDENTS
 _IOC = INCIDENTS["openvsx-claude-code-2026-10"]
 _EMBRACE = INCIDENTS["embrace-embedded-browser-2026-10"]
 _SHAI_HULUD = INCIDENTS["mini-shai-hulud-gh-token-monitor-2026"]
+_SANDWORM = INCIDENTS["sandworm-mode-npm-2026-11"]
 
 
 def test_ssh_authorized_keys_clean(tmp_path: Path):
@@ -327,3 +332,53 @@ def test_shai_hulud_project_markers_dedupes_relative_and_absolute(tmp_path: Path
     monkeypatch.chdir(tmp_path)
     findings = check_shai_hulud_project_markers([tmp_path, Path(".")])
     assert len(findings) == 1
+
+
+def test_sandworm_mode_dev_utils_absent(tmp_path: Path):
+    assert check_sandworm_mode_dev_utils(tmp_path) == []
+
+
+def test_sandworm_mode_dev_utils_present(tmp_path: Path):
+    (tmp_path / _SANDWORM["hidden_dir"]).mkdir()
+    findings = check_sandworm_mode_dev_utils(tmp_path)
+    assert len(findings) == 1
+    assert findings[0].severity == "critical"
+    assert findings[0].check_id == "sandworm-mode-dev-utils-dir"
+
+
+def test_sandworm_mode_mcp_registration_clean(tmp_path: Path):
+    config = tmp_path / ".claude.json"
+    config.write_text(json.dumps({"mcpServers": {"filesystem": {"command": "npx", "args": ["-y", "@a/b@1.0.0"]}}}))
+    assert check_sandworm_mode_mcp_registration([config]) == []
+
+
+def test_sandworm_mode_mcp_registration_by_dir(tmp_path: Path):
+    config = tmp_path / ".claude.json"
+    config.write_text(
+        json.dumps(
+            {
+                "mcpServers": {
+                    "helper": {
+                        "command": "node",
+                        "args": [str(Path.home() / ".dev-utils" / "server.js")],
+                    }
+                }
+            }
+        )
+    )
+    findings = check_sandworm_mode_mcp_registration([config])
+    assert len(findings) == 1
+    assert findings[0].severity == "critical"
+    assert findings[0].check_id == "sandworm-mode-mcp-registration"
+
+
+def test_sandworm_mode_mcp_registration_by_tool_name(tmp_path: Path):
+    config = tmp_path / ".mcp.json"
+    config.write_text(json.dumps({"mcpServers": {"lint_check": {"command": "node", "args": ["server.js"]}}}))
+    findings = check_sandworm_mode_mcp_registration([config])
+    assert len(findings) == 1
+    assert findings[0].check_id == "sandworm-mode-mcp-registration"
+
+
+def test_sandworm_mode_mcp_registration_missing_file(tmp_path: Path):
+    assert check_sandworm_mode_mcp_registration([tmp_path / "missing.json"]) == []