Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-02-26 · source-backed
The SANDWORM_MODE npm worm introduces a brand-new attack class: malicious MCP server injection via supply chain compromise. At least 19 typosquatted packages modify MCP configurations of Claude Code, Cursor, Windsurf, and VS Code Continue, installing rogue MCP servers that harvest credentials. The dormant dead switch adds a wiper capability. Builder opportunity: MCP security scanning tools (runtime monitoring, config integrity checking, tool manifest verification) are wide open as a product category.
Each link below shares sources, entities, or timing with this story.
Cursor uses MCP / Shared entities / Same source / Shared topic / Tension
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Cursor, MCP, VS Code Continue; cite the same source (SANDWORM_MODE npm worm).
Cursor uses MCP / Shared entities / Same source domain / Shared topic / What happened next / Tension
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Cursor, MCP, VS Code Continue; reported by the same outlet (socket.dev).
Cursor uses MCP / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Cursor, MCP, Windsurf; overlapping topics (attack, claude, code, config, configuration).
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Cursor, MCP, Windsurf; overlapping topics (attack, claude, code, server).
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Cursor, MCP, Windsurf; overlapping topics (claude, code, config, configuration).
Cursor uses MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Cursor, MCP, Windsurf; overlapping topics (category, claude, code, server, tool).
Cursor uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Cursor uses MCP); both cover Builder, Claude Code, Cursor, Windsurf; overlapping topics (builder, chain, claude, code).
Cursor uses MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Cursor, MCP, Windsurf; overlapping topics (claude, code, server).