CanisterSprawl
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Socket and StepSecurity began identifying a self-propagating npm supply chain worm tracked as CanisterSprawl... The worm executes via npm postinstall hook, harvests roughly 40 credential categories via regex sweep, and exfiltrates to a dual-channel endpoint that includes an Internet Computer Protocol (ICP) canister
Techniques & procedures
19 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
4 techniques
Initial Access
...injecting them with the malicious script and republishing them using the victim’s stolen npm credentials. Additionally, the script attempts to spread the attack to the Python Package Index (PyPI) when the necessary credentials are available...
The worm then attempts to self-propagate by identifying and installing npm packages the victim can publish, injecting them with the malicious script and republishing them using the victim’s stolen npm credentials.
Execution
3 techniques
Execution
The worm executes via npm postinstall hook... Trojanized cx-dev-assist ... silently downloaded a second-stage mcpAddon.js payload ... and executed it via the Bun runtime without integrity verification.
Trojanized cx-dev-assist (versions 1.17.0 and 1.19.0) and ast-results (versions 2.63.0 and 2.66.0) VS Code and Open VSX extensions were also identified, which silently downloaded a second-stage mcpAddon.js payload from a backdated commit in the official Checkmarx GitHub repository and executed it via the Bun runtime without integrity verification.
Persistence
2 techniques
Persistence
Privilege Escalation
2 techniques
Privilege Escalation
Stealth
1 technique
Stealth
Credential Access
5 techniques
Credential Access
The worm is cross-ecosystem, jumping from npm to PyPI if it discovers a PyPI publish token on the infected host.
The malicious postinstall script observed in this compromise works to harvest secrets from the victim’s environment by searching environment variables for names associated with tokens, credentials, cloud providers, CI/CD systems, registries, LLM platforms and other secrets. It also targets sensitive local system files including .npmrc, .git-credentials, .netrc, .env files, database password files, and files storing SSH keys and cloud credentials.
The payload swept AWS credentials, Google Cloud configurations, Kubernetes tokens, environment variables, SSH keys, API keys, and database credentials, exfiltrating to hxxps://whereisitat[.]lucyatemysuperbox[.]space/.
Discovery
1 technique
Discovery
Lateral Movement
1 technique
Lateral Movement
Collection
2 techniques
Collection
The payload swept AWS credentials, Google Cloud configurations, Kubernetes tokens, environment variables, SSH keys, API keys, and database credentials... The malicious payload ... exfiltrated GitHub tokens, npm tokens, SSH material, AWS/GCP/Azure secrets, GitHub Actions secrets, and AI tooling configuration files.
Command and Control
2 techniques
Command and Control
Exfiltration
1 technique
Exfiltration
The malicious payload contained the string "Shai-Hulud: The Third Coming" ... and exfiltrated GitHub tokens, npm tokens, SSH material, AWS/GCP/Azure secrets, GitHub Actions secrets, and AI tooling configuration files to public GitHub repositories created under victim accounts.
IOCs tracked for this family
7 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A self-propagating npm supply chain worm that executes via npm postinstall hooks, harvests roughly 40 credential categories, exfiltrates data to dual-channel infrastructure including an Internet Computer Protocol canister, and can jump from npm to PyPI when it finds a PyPI publish token.
A self-propagating npm supply chain worm that executes via postinstall, steals a broad set of credentials, exfiltrates data using ICP canister-based infrastructure, and can jump from npm to PyPI when publish tokens are found.
A self-propagating npm supply chain worm that executes via postinstall, steals a broad set of credentials, exfiltrates data using dual-channel infrastructure including an ICP canister, and can jump from npm to PyPI when publish tokens are found.
A worm payload in the same broader developer-targeting supply chain campaign, designed to extract credentials from developer and CI/CD pipeline environments.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.