Fetching from the wire…
01
02
03
04
05
06
07
08
Top 5 · 2026-02-26 · source-backed
A multi-stage npm supply chain worm dubbed SANDWORM_MODE deploys rogue MCP servers into configurations of Claude Code, Claude Desktop, Cursor, VS Code Continue, and Windsurf. At least 19 typosquatted packages harvest npm/GitHub tokens, SSH keys, and cloud credentials, then propagate by modifying other repositories and poisoning CI/CD workflows. Includes a dormant "dead switch" capable of wiping home directories. What to do: Run uvx mcp-scan@latest against every MCP server in your config. Verify your .claude/settings.json and .mcp.json haven't been modified by unknown packages. Pin dependencies and verify checksums for all AI coding tool packages.
Each link below shares sources, entities, or timing with this story.
Cursor uses MCP / Shared entities / Same source domain / Shared topic / What happened next / Tension
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Claude Desktop, Cursor, MCP; reported by the same outlet (socket.dev).
Cursor uses MCP / Shared entities / Same source / Shared topic / Tension
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Cursor, MCP, VS Code Continue; cite the same source (SANDWORM_MODE).
Cursor uses MCP / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Claude Desktop, Cursor, MCP; overlapping topics (claude, code, config).
Cursor uses MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Claude Desktop, Cursor, MCP; overlapping topics (claude, code, server).
Adversa AI criticizes Cursor / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Adversa AI criticizes Cursor); both cover Claude Code, Claude Desktop, Cursor, MCP; overlapping topics (claude, server, tool).
Cursor uses MCP / Shared entities / Shared topic / What happened next
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Cursor, GitHub, MCP; overlapping topics (claude, code, tool).
Cursor uses MCP / Shared entities / Shared topic / What happened next / Tension
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Cursor, MCP, Windsurf; overlapping topics (claude, code, coding, server).
Cursor uses MCP / Shared entities / Shared topic / Earlier coverage
Linked by a graph relationship (Cursor uses MCP); both cover Claude Code, Cursor, GitHub, MCP; overlapping topics (claude, code, server).