CanisterWorm

Once attackers obtain a valid npm publishing token or equivalent CI/CD access, they replace legitimate package contents with a malicious build... For each package, it automatically bumps the patch version, injects the malicious postinstall payload, and repushes to npm with npm publish --access public --tag latest.

A highly automated npm supply chain campaign, dubbed “CanisterWorm,” in which threat actors steal npm access tokens and weaponize legitimate publisher accounts at scale.

Researchers also found TeamPCP expand its operations to infect the npm ecosystem via a never-before-seen worm, called CanisterWorm, leveraging stolen publish tokens from the initial Trivy compromise.

The postinstall logic drops and launches a Python backdoor, then sets up persistence on Linux via a user-level systemd service named pgmon.

MITRE ATT&CK Mapping Technique ID Implementation Software Deployment Tools T1072 npm publish / PyPI upload abused as lateral movement and propagation

Once attackers obtain a valid npm publishing token or equivalent CI/CD access, they replace legitimate package contents with a malicious build that looks benign in version history but contains an extra postinstall hook. This hook runs automatically during npm install, so developers are infected simply by resolving dependencies, with no additional execution step.

In Kubernetes environments, it checked for mounted service account tokens to deploy privileged DaemonSets (node-setup-*, host-provisioner-iran).

Once attackers obtain a valid npm publishing token or equivalent CI/CD access, they replace legitimate package contents with a malicious build... For each package, it automatically bumps the patch version, injects the malicious postinstall payload, and repushes to npm with npm publish --access public --tag latest.

The postinstall logic drops and launches a Python backdoor, then sets up persistence on Linux via a user-level systemd service named pgmon, installed under ~/.config/systemd/user/pgmon.service.

MITRE ATT&CK Mapping Technique ID Implementation Event Triggered Execution T1546 GitHub Actions workflows triggered by push/discussion; IDE task hooks

Once attackers obtain a valid npm publishing token or equivalent CI/CD access, they replace legitimate package contents with a malicious build... For each package, it automatically bumps the patch version, injects the malicious postinstall payload, and repushes to npm with npm publish --access public --tag latest.

The postinstall logic drops and launches a Python backdoor, then sets up persistence on Linux via a user-level systemd service named pgmon, installed under ~/.config/systemd/user/pgmon.service.

MITRE ATT&CK Mapping Technique ID Implementation Event Triggered Execution T1546 GitHub Actions workflows triggered by push/discussion; IDE task hooks

MITRE ATT&CK Mapping Technique ID Implementation Obfuscated Files / Information T1027 AES-256-GCM encrypted payload constants; JS obfuscation; scramble()

Once attackers obtain a valid npm publishing token or equivalent CI/CD access, they replace legitimate package contents with a malicious build... For each package, it automatically bumps the patch version, injects the malicious postinstall payload, and repushes to npm with npm publish --access public --tag latest.

Once attackers obtain a valid npm publishing token or equivalent CI/CD access, they replace legitimate package contents with a malicious build that looks benign in version history but contains an extra postinstall hook. This hook runs automatically during npm install, so developers are infected simply by resolving dependencies, with no additional execution step.

In parallel, the JavaScript loader aggressively harvests npm credentials from multiple locations. It parses local .npmrc files in projects, the user’s ~/.npmrc, and /etc/npmrc for _authToken entries, and also inspects environment variables such as NPM_TOKEN and NPM_TOKENS.

...it allows them to steal API keys, cloud and database credentials, GitHub tokens, plus a ton of other secrets and sensitive information.

MITRE ATT&CK Mapping Technique ID Implementation Credentials from Files T1552.001 100+ filesystem hotspots across Linux/macOS/Windows

The Trivy payload’s primary objective was credential harvesting ... swept 50+ hardcoded filesystem paths for credentials: AWS configuration files, Docker Hub authentication tokens, PyPI publishing tokens, SSH keys ...

A deploy.js script uses the stolen credentials to query the npm registry search API (/-/v1/search) and enumerate all packages that the compromised user can publish.

In Kubernetes environments, it checked for mounted service account tokens to deploy privileged DaemonSets (node-setup-*, host-provisioner-iran).

MITRE ATT&CK Mapping Technique ID Implementation Software Deployment Tools T1072 npm publish / PyPI upload abused as lateral movement and propagation

Automated propagation via worming across software dependencies (T1210 / T1105). Deploying self-propagating malware (e.g., CanisterWorm) to spread through npm and developer workflows at scale

Given a single stolen npm publishing token, CanisterWorm enumerated every package within that token’s publishing scope, incremented version numbers, and inserted malicious code into new releases—completing this cycle in under 60 seconds per token.

For command and control, the backdoor repeatedly polls an Internet Computer Protocol (ICP) canister endpoint, specifically tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io, which acts as a dead-drop channel.

On Linux and macOS, the decoded Python script conducts credential collection ... exfiltrating results as tpcp.tar.gz via HTTP POST with the header X-Filename: tpcp.tar.gz to the same C2 IP address.

For command-and-control, TeamPCP employed Internet Computer Protocol (ICP) blockchain canisters—decentralized, immutable smart contracts hosted on the ICP network.

This malware uniquely leverages an ICP canister, a tamperproof smart contract on the Internet Computer blockchain, as a dead drop resolver for its command-and-control (C2) server.

Automated propagation via worming across software dependencies (T1210 / T1105). Deploying self-propagating malware (e.g., CanisterWorm) to spread through npm and developer workflows at scale

The HTTP exfiltration channel used the identifying header X-Filename: tpcp.tar.gz , which provides a reliable network detection signature for retrospective traffic analysis.

MITRE ATT&CK Mapping Technique ID Implementation Exfiltration Over Web Service T1567.002 GitHub repo commits; GitHub Actions artifacts; P2P Session network

reported a probabilistic sabotage mechanism with a 1-in-6 chance of running a recursive wipe on systems matching Israeli or Iranian locales... The original TeamPCP campaign report documented a conditional wiper... attempted to destroy data, wiping Kubernetes clusters node by node, or the local machine if no cluster was found.

Researchers have additionally observed activity involving CanisterWorm, malware that targeted Kubernetes environments and reportedly deployed destructive functionality against selected Iranian targets.