Loading story…
Researchers reported a worm-enabled npm supply-chain attack dubbed CanisterWorm that backdoored at least 29 legitimate packages, including 28 in the @EmilGroup scope and @teale.io/eslint-config. The attackers appear to have used stolen npm publishing tokens or equivalent CI/CD access to replace package contents, republish trojanized updates under the latest tag, and spread the malware across additional packages available to the compromised credentials. Aikido linked the activity to TeamPCP and assessed it as a likely follow-on from the earlier Trivy compromise, while Socket said the operation showed high-confidence signs of a legitimate publisher-space takeover with worm-like propagation.
The infection chain used a Node.js postinstall loader, a Python backdoor, and an Internet Computer Protocol canister as a dead-drop command-and-control channel for dynamic payload delivery. On Linux, the malware established persistence through a user-level systemd service, disguised files as PostgreSQL-related artifacts, delayed execution to evade sandboxing, and used a propagation script to enumerate publishable packages, bump patch versions, preserve READMEs, and publish malicious updates at scale. At the time of reporting, the ICP canister returned a Rickroll URL as a dormant kill switch, but researchers warned it could be changed at any time to deliver a real second-stage binary to developers, CI runners, and build systems that installed the compromised packages.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
13 events from the most recent confirmed update back to the earliest known activity.
On 2026-04-22, Expel reported a separate software supply-chain incident involving the xinference AI model serving framework. The malicious code was described as harvesting AWS, Azure, and Google Cloud credentials, along with SSH keys and Kubernetes secrets, expanding the story beyond the previously documented npm-focused Namastex/CanisterWorm activity.
On 2026-04-22, Socket reported a developing supply-chain incident affecting Namastex Labs-related npm packages, primarily @automagik/genie and pgserve, with install-time malware that steals credentials and wallet data, exfiltrates data, and attempts to self-propagate to npm and PyPI. The report also linked shared malware/key material to malicious packages in the @fairwords and @openwebconcept namespaces, indicating expansion into additional publisher spaces with tradecraft overlapping CanisterWorm/TeamPCP-style activity.
Socket said the Namastex-linked CanisterSprawl activity had affected 22 packages starting on 2026-04-08. The wave was assessed as part of the broader CanisterWorm campaign and involved self-propagating malware targeting npm and, where possible, PyPI.
StepSecurity reported that attackers used harvested npm tokens from compromised CI/CD environments to publish backdoored patch versions across additional npm namespaces, including more than 16 packages in the @opengov scope. This represents a newly disclosed victim set beyond the previously reported @EmilGroup and @teale.io/eslint-config packages.
On 2026-03-22, JFrog reported newly identified compromised npm package versions tied to CanisterWorm, expanding the known list of affected packages beyond earlier public disclosures. The report reiterated TeamPCP attribution and detailed token theft from npm credentials and CI/CD environments used to republish malicious updates under compromised maintainer accounts.
Aikido researcher Charlie Eriksen said the malicious Internet Computer canister associated with CanisterWorm was taken down on Sunday night, ending availability of the malware at that time. The action disrupted the campaign’s dead-drop command channel after its earlier use in the npm supply-chain attack.
Within 48 hours of the initial npm supply-chain activity, researchers reported that CanisterWorm began targeting Kubernetes environments associated with Iran, especially systems in the Asia/Tehran timezone. In these cases, the malware spread via DaemonSet and deployed the destructive Kamikaze wiper, marking a shift from credential theft and backdoor delivery to destructive attacks.
Researchers reported a newer CanisterWorm variant in @teale.io/eslint-config that steals npm tokens during installation and automatically republishes malicious packages using the victim's credentials. This marked an escalation in the campaign by turning infected developers and CI pipelines into new propagation vectors.
At the time of reporting, the malware's ICP canister returned a Rickroll YouTube URL instead of a live second-stage payload, suggesting a dormant or kill-switch state. Researchers warned the actor could change the canister response at any time to deliver a real binary payload.
On 2026-03-20, Aikido and Socket disclosed the CanisterWorm campaign as a worm-enabled npm supply-chain attack affecting legitimate publisher namespaces. Aikido linked the activity to TeamPCP and assessed it as a likely follow-up to the Trivy compromise reported by Wiz less than 24 hours earlier, while Socket described the same campaign without firm attribution.
The trojanized packages used a Node.js postinstall stage to install a persistent Python implant on Linux via a user-level systemd service, disguising artifacts as PostgreSQL-related files. The malware then polled an Internet Computer Protocol canister as a dead-drop command-and-control channel for second-stage payload URLs.
Using stolen publisher access, the attackers pushed malicious versions of 28 packages in the @EmilGroup scope and @teale.io/eslint-config, publishing them under the latest tag to maximize installation. The campaign used a worm-like propagation tool to enumerate additional publishable packages, bump versions, preserve READMEs, and spread through accessible accounts.
Threat actors appear to have obtained npm publishing tokens or equivalent CI/CD publishing access for legitimate publisher namespaces, including the @EmilGroup scope and likely @teale.io/eslint-config. This access enabled them to replace legitimate package contents and publish trojanized updates.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
18 references tracked. Mallory keeps watching after this page renders.
scworld.com
Open sourceexpel.com
Open sourcecybersecuritynews.com
Open sourcecyberpress.org
Open sourcemend.io
Open sourcethehackernews.com
Open sourcesocket.dev
Open sourceaikido.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Security researchers reported multiple self-propagating npm supply-chain malware campaigns that used compromised maintainer accounts and poisoned package updates to infect developer and CI/CD environments. JFrog said **IronWorm** was distributed through 36–37 malicious npm packages republished from the compromised `asteroiddao` account, where `preinstall` hooks launched a Rust ELF payload on Linux. The malware stole credentials and secrets tied to AWS, npm, SSH, Vault, OpenAI, Anthropic, Kubernetes, and Exodus wallets, hid with an **eBPF rootkit**, and used **Tor** for command-and-control. Investigators also linked the activity to poisoned GitHub repositories across nine organizations, including backdated malicious commits attributed to spoofed automation identities such as `claude`, `dependabot[bot]`, `renovate[bot]`, and `github-actions[bot]`. A separate but related wave, tracked by Sonatype as **Shai-Hulud "Miasma"**, pushed 281 malicious npm package versions and used `binding.gyp` with `node-gyp` to execute during installation, bypassing defenses that only inspect lifecycle scripts. Like IronWorm, the malware harvested developer and CI/CD secrets, validated stolen access, and republished trojanized versions of legitimate packages to continue spreading through repositories, build systems, and registries. Researchers said active exploitation was observed in the wild and warned that public impact may understate the full scope, particularly where private projects and CI runners were exposed through trusted publishing flows and compromised maintainer credentials.
Jul 12, 2026
Security researchers reported multiple **software supply chain** campaigns targeting developers through malicious packages in public repositories, aiming to steal credentials/secrets and establish persistent access that can later impact production environments. Socket disclosed a campaign dubbed **StegaBin** involving **26 malicious npm packages** published over a two-day window that used a Pastebin “dead-drop” with **character-level steganography** to conceal C2 details, then resolved additional infrastructure across **31 Vercel deployments** to deliver platform-specific shell payloads that install a RAT and a **nine-module infostealer** targeting VSCode data, SSH keys, git repositories, browser credential stores, clipboard contents, and other local secrets. Socket assessed the tradecraft as consistent with activity previously attributed to **North Korea-aligned FAMOUS CHOLLIMA (Lazarus-linked)** and noted rapid detection of the packages shortly after publication. Separately, reporting highlighted **four malicious NuGet packages**—`NCryptYo`, `DOMOAuth2_`, `IRAOAuth2.0`, and `SimpleWriter_`—that targeted **ASP.NET** developers by exfiltrating **ASP.NET Identity** data (users/roles/permissions) and enabling backdoors; the packages were published in August 2024, accumulated **4,500+ downloads**, and were later removed. In that campaign, `NCryptYo` functioned as a dropper and proxy to an attacker-controlled C2, while `DOMOAuth2_` and `IRAOAuth2.0` handled data theft and backdoor rule delivery, and `SimpleWriter_` enabled file writing and hidden process execution while masquerading as a PDF utility. Other items in the set described unrelated C2 tooling trends (a Polygon blockchain-based botnet loader and the Vshell C2 framework) and do not describe the same package-repository supply chain incidents.
Jun 29, 2026
Attackers linked by multiple researchers to **TeamPCP** hijacked the npm maintainer account `atool` and used it to publish roughly **639 malicious versions across 323 packages**, heavily impacting Alibaba’s **`@antv/*`** ecosystem as well as packages such as `echarts-for-react`, `timeago.js`, and `size-sensor`. Reports said the malware executed through malicious `preinstall` hooks and an obfuscated Bun-based payload, stealing secrets from developer workstations and CI/CD systems including GitHub, npm, AWS, Kubernetes, Vault, SSH, Docker, and database credentials. The campaign also abused GitHub tokens to create attacker-controlled repositories for exfiltration, scraped GitHub Actions runner memory for plaintext secrets, and in some cases targeted trusted tooling including a briefly compromised **Nx Console** VS Code extension. Researchers said the operation was worm-like and self-propagating, using stolen npm tokens to tamper with and republish additional packages under legitimate maintainer identities, with the broader **Mini Shai-Hulud** activity now tracked across npm, PyPI, and Composer. The malware reportedly established persistence in developer environments through modified VS Code and Claude Code settings and OS-level services, while some reports warned it also attempted to forge valid **Sigstore/SLSA provenance** using stolen CI identities. In response, **npm invalidated all write-enabled granular access tokens that bypassed two-factor authentication** and introduced **Staged Publishing** in preview, but researchers warned that any machine or pipeline that installed affected versions should be treated as fully compromised and all reachable credentials rotated immediately.
Jun 29, 2026