Loading malware…
CanisterWorm is a self-propagating supply-chain worm associated with the financially motivated threat group TeamPCP. It emerged during the group’s 2026 campaign against developer tooling and CI/CD ecosystems, where stolen publishing credentials were reused to spread malicious package updates at scale. The malware is notable for using Internet Computer Protocol canisters as resilient dead-drop command-and-control infrastructure, a design that complicates conventional infrastructure disruption and takedown efforts.
CanisterWorm primarily targeted npm and developer environments, where it searched for package publishing credentials and automatically propagated to packages the compromised identity was authorized to modify. Reported behavior included resolving publisher ownership, enumerating accessible packages, incrementing package versions, and rapidly publishing trojanized updates. The worm was also observed persisting on Linux systems through user-level systemd services while polling its decentralized resolver for updated payload locations.
Beyond propagation, CanisterWorm was used to harvest sensitive authentication material, including cloud access tokens, credentials, and API keys associated with major cloud providers. It was also linked to Kubernetes-focused post-compromise activity. In cluster environments, TeamPCP used privileged DaemonSets and host-mounted access to spread across nodes, masquerade as legitimate services or utilities, and either establish persistence or execute destructive actions. Multiple reports characterize the Kubernetes component as capable of recursive file deletion across affected clusters, with some variants or follow-on payloads conditionally activating a wiper when Iranian locale or timezone indicators were detected.
CanisterWorm sits at the intersection of credential theft, worm-like propagation, persistence, and destructive post-exploitation. It was deployed after earlier TeamPCP compromises of trusted CI/CD and security tooling yielded stolen publish tokens and cloud secrets, allowing the actor to pivot from initial supply-chain access into broader downstream compromise across software ecosystems and containerized infrastructure.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2026-33634 (CVSS4B 9.4, Critical) has been assigned to the Trivy ecosystem compromise and was added to CISA's Known Exploited Vulnerabilities Catalog on March 26, 2026.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182.
Aikido Security - TeamPCP deploys CanisterWorm on NPM ... CanisterWorm — Self-propagating worm using ICP Canister for C2 ... File System Indicators /tmp/pglog (CanisterWorm payload drop path)
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Concurrently, a worm variant designated CanisterWorm was observed using the ICP canister C2 infrastructure to propagate across Kubernetes environments, masquerading as systemd services and the PostgreSQL utility pgmon, and executing recursive file deletion in affected clusters [4].
31 distinct techniques documented for this family, organized by ATT&CK tactic.
The attacker also compromised the aqua-bot service account and then abused their access push malicious workflows to tfsec, traceeshark, and trivy-action and steal additional credentials from Aqua.
The worm’s distinguishing feature is autonomous propagation: compromised packages include a findNpmTokens() function that locates npm authentication tokens in the installing developer’s environment and autonomously publishes the malware to every package the victim has publish rights to
Between late February and March 2026, threat group TeamPCP conducted a highly calculated, escalating sequence of supply chain threats. It systematically compromised widely trusted open-source security tools... These ongoing supply chain attacks injected malicious infostealer payloads directly into GitHub Actions and Python Package Index (PyPI) registries.
The malware attempted to deploy a highly privileged DaemonSet to any Kubernetes cluster accessible via harvested kubeconfig files.
Version 1 - Monolithic Architecture : A 150-line bash script focused on environment fingerprinting and immediate credential harvesting... Version 2 also introduced a self-deletion command rm – “$0” to remove itself after execution.
Distributed via malicious postinstall hooks in compromised npm packages, the worm installed a Python backdoor that persisted via a systemd user service named pgmon and polled an Internet Computer Protocol canister...
The malware attempted to deploy a highly privileged DaemonSet to any Kubernetes cluster accessible via harvested kubeconfig files.
The attacker also compromised the aqua-bot service account and then abused their access push malicious workflows to tfsec, traceeshark, and trivy-action and steal additional credentials from Aqua.
The malware attempted to deploy a highly privileged DaemonSet to any Kubernetes cluster accessible via harvested kubeconfig files.
The attacker also compromised the aqua-bot service account and then abused their access push malicious workflows to tfsec, traceeshark, and trivy-action and steal additional credentials from Aqua.
the malware exfiltrated stolen data to the vendor-themed typosquat domain checkmarx[.]zone ... Beyond stealing credentials and achieving persistence, the threat actors also masqueraded their activity as legitimate services like systemd and disguised the threat as a PostgreSQL utility called pgmon
The script functioned as a comprehensive secret-sweeper where it harvested: SSH keys Cloud credentials (AWS, Google Cloud, Azure) Kubernetes configuration files
This secondary payload performs environment fingerprinting to identify Kubernetes clusters...
Version 3 enabled the scanning of exposed Docker APIs, port 2375 and the local subnet.
The worm’s distinguishing feature is autonomous propagation: compromised packages include a findNpmTokens() function that locates npm authentication tokens in the installing developer’s environment and autonomously publishes the malware to every package the victim has publish rights to
If the primary C2 server failed, the payload used the backup domain tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0[.]io .
CanisterWorm uses a decentralized Internet Computer Protocol (ICP) canister for C2, providing a tamper-proof dead-drop for payload delivery that is resistant to typical worm takedown operations.
The backdoor polls this endpoint every approximately 50 minutes using a spoofed browser User-Agent string.
the malware was silently exfiltrating data to the typosquatted domain scan.aquasecurtiy[.]org . If the primary C2 server failed, the payload used the backup domain tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0[.]io .
Primary: HTTPS POST to scan.aquasecurtiy[.]org (45.148.10.212) with header X-Filename: tpcp.tar.gz. Fallback: If the C2 returns non-2xx and INPUT_GITHUB_PAT is available, the malware creates a public repository called tpcp-docs on the victim’s own GitHub account and uploads the bundle as a release asset.
The campaign recently integrated a destructive wiper component... deploying privileged DaemonSets to brick entire clusters or executing recursive file deletions on non-containerized hosts.
98 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
104 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A self-propagating npm worm that harvested npm tokens from compromised environments, authenticated to npm, enumerated publishable packages, bumped package versions, and republished malicious packages. Its payload chain installed a persistent Python backdoor via systemd and polled an ICP canister for updated payloads.
Self-propagating malware used in TeamPCP supply chain attacks to steal cloud credentials, API keys, SSH keys, and Kubernetes secrets.
Credential-stealing malware used to harvest cloud access tokens, credentials, and API keys from AWS, GCP, and Azure environments.
Credential-stealing malware used to harvest cloud access tokens, credentials, and API keys from AWS, GCP, and Azure environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.