Security researchers have identified a highly sophisticated npm supply chain attack dubbed CanisterWorm. Orchestrated by a threat actor tracked as “TeamPCP,” the campaign successfully compromises legitimate npm publisher namespaces.
The attackers inject malicious payloads into SDK packages, creating a wormable threat that autonomously spreads across the broader npm ecosystem.
Attack Mechanics and Propagation
The infection lifecycle begins during package installation when a malicious postinstall script inside package.json triggers the deployment of a Python backdoor.
On Linux environments, the malware establishes persistence by using systemd-user to create a hidden background service named pgmon.
For command and control (C2), CanisterWorm leverages a decentralized approach by continuously polling an Internet Computer Protocol (ICP) canister.
systemctl --user stop pgmon.service && systemctl --user disable pgmon.serviceThis canister acts as a dead-drop C2 channel, delivering secondary payloads that the malware saves to /tmp/pglog while tracking its execution state in a /tmp/—pg_state file.
The core objective of the initial payload is to harvest credentials aggressively. The malware explicitly scans local project directories, user home directories, and system-wide configurations for .npmrc files to extract _authToken values.
It also targets the NPM_TOKEN and NPM_TOKENS environment variables to capture elevated permissions.
rm -rf node_modules
npm cache clean --forceOnce credentials are stolen, the worm’s autonomous propagation module takes over using a script named deploy.js.
The script authenticates against the npm registry, enumerates all packages maintained by the compromised user, increments the patch version, and publishes the malicious update to infect downstream users.
Remediation and Compromised Packages
| Package Name | Compromised Version | X-Ray ID |
|---|---|---|
| @emilgroup/discount-sdk | 1.5.1 | Unreported |
| @emilgroup/document-uploader | 0.0.10 | Unreported |
| @emilgroup/docxtemplater-util | 1.1.2 | Unreported |
| @emilgroup/numbergenerator-sdk-node | 1.3.1 | Unreported |
| @emilgroup/partner-portal-sdk | 1.1.1 | Unreported |
| @emilgroup/setting-sdk | 0.2.1 | Unreported |
| @emilgroup/task-sdk | 1.0.2 | Unreported |
| @emilgroup/task-sdk-node | 1.0.2 | Unreported |
If your environment is exposed to this campaign, immediate containment is required to stop the worm from self-propagating using your credentials.
Follow jfrog these sequence-critical steps to secure your environment:
- Rotate all npm publishing tokens and CI/CD secrets immediately, ensuring new credentials utilize granular access policies with strict expiration dates.
- Eradicate Linux persistence by executing systemctl –user stop pgmon. service && systemctl –user turn off pgmon. service.
- Remove malicious staging artifacts by deleting ~/.config/systemd/user/pgmon.service, ~/.local/share/pgmon/, /tmp/pglog, and /tmp/.pg_state.
- Purge infected dependencies by deleting the node_modules folder, running npm cache clean –force, and locking package.json to known safe versions.
- Manually unpublish any compromised patch versions from the npm registry to protect downstream users if your namespace was successfully breached.
- Disable silent postinstall hooks globally by running npm config set ignore-scripts true to prevent future script execution attacks.
Continuous threat intelligence monitoring has recently identified several previously unreported package versions tied to this campaign. Below is a consolidated table of newly discovered and known compromised packages to cross-reference against your dependencies.
Follow us on Google News , LinkedIn and X to Get More Instant Updates. Set Cyberpress as a Preferred Source in Google.
