CanisterWorm

Additionally, the worm used stolen developer secrets to modify accessible packages and push the malicious versions to the registry, expanding the attack surface.

The worm operated autonomously, stealing npm authentication tokens from compromised environments, resolving which packages each token could publish, incrementing patch version numbers to trigger routine update workflows, and republishing poisoned copies while preserving original READMEs to avoid raising maintainer suspicion.

It started with Aqua Security’s Trivy scanner and propagated downstream to multiple packages and repositories in a ripple effect fueled by the malware’s worm-like behavior and by the automated inclusion of the malicious libraries in more builds.

La campagne TeamPCP est une série d’attaques supply chain ciblant des outils open source largement utilisés dans les pipelines CI/CD. Des GitHub Actions, extensions OpenVSX et packages npm/PyPI ont été compromis et des versions malveillantes publiées.

Attackers hide malicious code in npm packages, transitive dependencies, Git repositories, or remotely hosted dependency artifacts that npm resolves during installation.

Version 1 - Monolithic Architecture : A 150-line bash script focused on environment fingerprinting and immediate credential harvesting...

They were injected with a .pth file that Python automatically executed at interpreter startup, even if LiteLLM was never imported, bypassing ignore-scripts protections.

“The Shai-Hulud malware family repeatedly abused npm lifecycle scripts to execute malicious code during package installation” and a compromised package used a "preinstall": "node setup.mjs" script.

deploying privileged DaemonSets to brick entire clusters

Additionally, the worm used stolen developer secrets to modify accessible packages and push the malicious versions to the registry, expanding the attack surface.

the payload used the victim's own GITHUB_TOKEN to create a hidden repository named docs-tpcp located within the victim's GitHub organization.

T1543.002 — Create or Modify System Process: Systemd Service (Persistence)

Additionally, the worm used stolen developer secrets to modify accessible packages and push the malicious versions to the registry, expanding the attack surface.

the payload used the victim's own GITHUB_TOKEN to create a hidden repository named docs-tpcp located within the victim's GitHub organization.

T1543.002 — Create or Modify System Process: Systemd Service (Persistence)

the malware exfiltrated stolen data to the vendor-themed typosquat domain checkmarx[.]zone .

Additionally, the worm used stolen developer secrets to modify accessible packages and push the malicious versions to the registry, expanding the attack surface.

CanisterWorm “harvested npm authentication tokens and attempted to spread itself by compromising additional packages.”

It also swept 50+ filesystem paths for SSH keys, AWS/GCP/Azure credentials, Kubernetes tokens, Docker configs, and cryptocurrency wallets.

"Long-lived credentials were found sitting in compromised repositories" and compromised packages searched environments for additional npm tokens.

malicious code was automatically executed when the infected package was fetched and run to harvest credentials, tokens, API keys, and other secrets.

malicious code was automatically executed when the infected package was fetched and run to harvest credentials, tokens, API keys, and other secrets.

This secondary payload performs environment fingerprinting to identify Kubernetes clusters

v3 Pure SSH/Docker worm (scans local /24 for ports 22, 2375)

The worm operated autonomously, stealing npm authentication tokens from compromised environments, resolving which packages each token could publish, incrementing patch version numbers to trigger routine update workflows, and republishing poisoned copies while preserving original READMEs to avoid raising maintainer suspicion.

extracting sensitive data, including but not limited to cloud access tokens, SSH keys, and Kubernetes secrets

One of the most striking aspects of the campaign was its extensive use of legitimate platforms for C2 and exfiltration. Rather than relying exclusively on traditional malware infrastructure, the attackers used GitHub repositories as dead-drop locations for stolen data.

Exfiltration chiffrée AES-256-GCM + RSA vers un endpoint imitant Checkmarx, avec dead-drop sur des dépôts GitHub aux noms thématiques Dune.

rely on automated and wormable exploitation techniques for self-propagation

the Python backdoor slept 5 minutes ... then polled the ICP canister ... for a URL pointing to the current payload.

Primary channel was HTTPS POST to scan.aquasecurtiy[.]org ... Fallback: if INPUT_GITHUB_PAT was available, the malware created a public tpcp-docs repository on the victim’s GitHub account and uploaded the encrypted bundle as a release asset.

In March 2026, the group also launched a large-scale supply chain attack involving CanisterWorm, which not only steals credentials or installs backdoors, but also wipes entire Kubernetes clusters.

Harvested data was encrypted using AES-256-CBC with RSA-4096 hybrid encryption ... Only the attacker’s private key can decrypt.