A dangerous new npm supply chain attack has emerged, compromising packages linked to Namastex.ai and delivering a sophisticated malware known as CanisterWorm.
Unlike traditional malware, this threat doesn’t just infect systems—it spreads automatically across the npm ecosystem, leveraging stolen credentials and trusted package updates.
Even more concerning, the campaign mirrors tactics used by the TeamPCP threat group, known for targeting developer pipelines and open-source ecosystems.
With over 135 malicious packages identified, this attack highlights a growing crisis in software supply chain security.
In this article, you’ll learn:
- How the CanisterWorm malware works
- How npm tokens are abused for propagation
- What data is being stolen
- Why this attack is difficult to detect
- How to protect your development environment
What Is the CanisterWorm npm Supply Chain Attack?
The CanisterWorm attack is a large-scale compromise of npm packages where attackers:
- Gain access to legitimate publishing tokens
- Replace package code with malicious payloads
- Republish infected versions under trusted names
- Automatically spread to other packages
Key Characteristics
- Targets developer environments
- Uses legitimate package namespaces
- Appears as routine updates
- Includes self-propagating worm behavior
How the Attack Works
Infection Flow
Compromised Token → Malicious Package Publish → Developer Install → Token Theft → Further Propagation
Step-by-Step Breakdown
1. Token Compromise
Attackers obtain npm tokens via:
- Compromised CI/CD pipelines
- Exposed environment variables
- Credential leaks
2. Package Hijacking
Using valid tokens, attackers:
- Remove legitimate package code
- Inject malicious payload
- Republish with a higher patch version
- Maintain original metadata (README, naming)
3. Silent Installation
When developers install or update:
- The malicious package executes automatically
- No visible warnings are shown
4. Postinstall Execution
A hidden postinstall script runs:
- Immediately after installation
- Without user interaction
Self-Propagation: What Makes CanisterWorm Unique
Unlike typical malware, CanisterWorm includes worm-like capabilities.
Token Harvesting Function
The malware executes:
findNpmTokens()
It extracts credentials from:
~/.npmrcfiles- Project-level configs
- Environment variables (e.g.,
NPM_TOKEN) - npm CLI configurations
Automated Propagation
The malware then:
- Identifies accessible packages
- Increments version numbers
- Injects payload into each package
- Republishes them as “latest”
Result:
👉 Every infected developer becomes a new distribution point
Data Exfiltration Capabilities
Beyond spreading, CanisterWorm performs extensive data theft.
Targeted Data Includes:
- Environment variables
- SSH keys
- AWS, Azure, GCP credentials
- Kubernetes service tokens
- Docker registry credentials
- TLS private keys
Developer & User Data
- Browser-stored credentials
- Crypto wallets (MetaMask, Phantom)
Exfiltration Method
- Uses RSA encryption over HTTPS
- Sends data to an ICP (Internet Computer Protocol) canister
Why ICP-Based C2 Is Significant
Instead of traditional servers, CanisterWorm uses:
Decentralized ICP canisters as command-and-control (C2)
Advantages for attackers:
- Harder to take down
- Dynamic payload delivery
- Persistent communication channel
Attribution: TeamPCP Threat Actor
Security researchers attribute this campaign to:
TeamPCP (high confidence)
Known for:
- Supply chain attacks
- Targeting developer tools (e.g., Trivy)
- Credential harvesting campaigns
Campaign Scale
- 135+ malicious packages
- 64+ compromised namespaces
- Cross-ecosystem targeting (npm + PyPI)
Why This Attack Is Hard to Detect
1. Trusted Package Names
- Uses legitimate namespaces
- Maintains original metadata
2. Version Increment Trick
- Appears as normal patch updates
- Automatically installed in CI pipelines
3. Silent Execution
- Postinstall scripts run invisibly
- No terminal alerts
4. Legitimate Credential Usage
- No brute force or exploits needed
- Uses valid authentication tokens
Real-World Impact
1. Developer Environment Compromise
- Full access to local systems
- Credential exposure
2. Cloud Infrastructure Breach
- Access to AWS, Azure, GCP environments
- Kubernetes cluster compromise
3. Supply Chain Contamination
- Rapid spread across organizations
- Trust erosion in open-source ecosystems
Common Misconceptions
❌ “Open-source packages are safe by default”
They are only as secure as their maintainers and pipelines.
❌ “Version updates are always safe”
Attackers exploit automatic updates.
❌ “CI/CD systems are secure”
They are prime targets for credential theft.
Mitigation and Defense Strategies
1. Rotate All Credentials Immediately
If affected:
- npm tokens
- GitHub tokens
- Cloud credentials
- SSH keys
2. Audit Package History
Look for:
- Unexpected version bumps
- Suspicious publish activity
3. Disable Automatic Script Execution
- Block
postinstallscripts - Enable install-time script auditing
4. Enforce Dependency Pinning
- Use exact version locking
- Avoid automatic “latest” installs
5. Secure CI/CD Pipelines
- Store tokens securely
- Use short-lived credentials
- Apply least privilege access
6. Monitor for Indicators of Compromise
- Known RSA key fingerprints
- File hash indicators
- Suspicious outbound traffic
Expert Insight: The Evolution of Supply Chain Attacks
This campaign highlights a major shift:
From targeting systems → to targeting developers and pipelines
Modern attackers aim to:
- Infect upstream dependencies
- Spread through trusted ecosystems
- Scale attacks exponentially
FAQs
What is CanisterWorm malware?
A self-propagating backdoor that spreads via npm packages and steals credentials.
How does the npm supply chain attack work?
Attackers use stolen tokens to publish malicious versions of legitimate packages.
What makes this attack dangerous?
It spreads automatically and targets sensitive developer and cloud credentials.
What is TeamPCP?
A threat actor linked to supply chain attacks and developer ecosystem compromises.
How can developers protect themselves?
Pin dependencies, audit packages, and secure credentials.
Is this limited to npm?
No, similar propagation behavior has been observed targeting PyPI.
Conclusion: A Wake-Up Call for Developer Security
The CanisterWorm npm supply chain attack is a clear signal that the software supply chain is now a primary attack surface.
Key Takeaways:
- Trusted packages can be weaponized
- Credential security is critical
- Automated updates increase risk
- Supply chain attacks scale rapidly
Organizations must adopt a zero-trust approach to dependencies and strengthen controls across their development pipelines.
