Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens

Summary

Researchers detected CanisterSprawl, a self-propagating supply chain worm targeting npm packages that uses postinstall hooks to steal developer credentials, SSH keys, cloud tokens, and npm tokens from compromised environments. The malware exfiltrates stolen data to an HTTPS webhook and ICP canister, then leverages stolen tokens to publish poisoned package versions, enabling rapid spread across the ecosystem. The campaign also includes related attacks on PyPI packages and GitHub Actions workflows, demonstrating coordinated efforts to compromise the open-source supply chain.

Full text

Self-Propagating Supply Chain Worm Hijacks npm Packages to Steal Developer Tokens Ravie LakshmananApr 22, 2026Malware / DevOps Cybersecurity researchers have flagged a fresh set of packages that have been compromised by bad actors to deliver a self-propagating worm that spreads through stolen developer npm tokens. The supply chain worm has been detected by both Socket and StepSecurity, with the companies tracking the activity under the name CanisterSprawl owing to the use of an ICP canister to exfiltrate the stolen data, in a tactic reminiscent of TeamPCP's CanisterWorm to make the infrastructure resilient to takedowns. The list of affected packages is below - @automagik/genie (4.260421.33 - 4.260421.40) @fairwords/loopback-connector-es (1.4.3 - 1.4.4) @fairwords/websocket (1.0.38 - 1.0.39) @openwebconcept/design-tokens (1.0.1 - 1.0.3) @openwebconcept/theme-owc (1.0.1 - 1.0.3) pgserve (1.1.11 - 1.1.14) The malware is triggered during install time via a postinstall hook to steal credentials and secrets from developer environments, and then leverage the stolen npm tokens to push poisoned versions of the packages to the registry with a new malicious postinstall hook so as to expand the reach of the campaign. Captured information includes - .npmrc SSH keys and SSH configurations .git-credentials .netrc cloud credentials for Amazon Web Services, Google Cloud, and Microsoft Azure Kubernetes and Docker configurations Terraform, Pulumi, and Vault material Database password files Local .env* files Shell history files In addition, it attempts to access credentials from Chromium-based web browsers and data associated with cryptocurrency wallet extension apps. The information is exfiltrated to an HTTPS webhook ("telemetry.api-monitor[.]com") and an ICP canister ("cjn37-uyaaa-aaaac-qgnva-cai.raw.icp0[.]io"). "It also contains PyPI propagation logic," Socket said. "The script generates a Python .pth-based payload designed to execute when Python starts, then prepares and uploads malicious Python packages with Twine if the required credentials are present." "In other words, this is not just a credential stealer. It is designed to turn one compromised developer environment into additional package compromises." The disclosure comes as JFrog revealed that multiple versions of the legitimate Python package "xinference" (2.6.0, 2.6.1, and 2.6.2) have been compromised to include a Base64-encoded payload that fetches a second-stage collector module responsible for harvesting a wide range of credentials and secrets from the infected host "The decoded payload opens with the comment '# hacked by teampcp,' the same actor marker seen in recent TeamPCP compromises," the company said. However, in a post shared on X, TeamPCP disputedthey were behind the compromise and claimed it was the work of a copycat. Attacks Target npm and PyPI The findings are the latest additions to a long list of attacks that have targeted the open-source ecosystem. This includes two malicious packages, each on npm (kube-health-tools) and PyPI (kube-node-health), that masquerade as Kubernetes utilities, but silently install a Go-based binary to establish a SOCKS5 proxy, a reverse proxy, an SFTP server, and a large language model (LLM) proxy on the victim's machine. The LLM proxy is an OpenAI-compatible API gateway that accepts requests and routes them to upstream APIs, including Chinese LLM routers like shubiaobiao. "Beyond providing cheap access to AI, LLM routers like the one deployed here sit on a trust boundary that is easily abused," Aikido Security researcher Ilyas Makari said. "Because every request passes through the router in plaintext, a malicious operator can [...] inject malicious tool calls into responses of coding agents before they reach the client, introducing malicious pip install or curl | bash payloads mid-flight." Alternatively, the router can be used to exfiltrate secrets from request and response bodies, including API keys, AWS credentials, GitHub tokens, Ethereum private keys, and system prompts. Another sustained npm supply chain attack campaign documented by Panther has impersonated phone insurance provider Asurion and its subsidiaries, publishing malicious packages (sbxapps, asurion-hub-web, soluto-home-web, and asurion-core) from April 1 through April 8, 2026, containing a multi-stage credential harvester. The stolen credentials were exfiltrated initially to a Slack webhook and then to an AWS API Gateway endpoint ("pbyi76s0e9.execute-api.us-east-1.amazonaws[.]com"). By April 7, the AWS exfiltration URL is said to have been obfuscated using XOR encoding. Last but not least, Google-owned cloud security firm Wiz shed light on an artificial intelligence (AI)-powered campaign dubbed prt-scan that has systematically exploited the "pull_request_target" GitHub Actions workflow trigger since March 11, 2026, to steal developer secrets. The attacker, operating under the accounts testedbefore, beforetested-boop, 420tb, 69tf420, elzotebo, and ezmtebo, has been found to search for repositories using the trigger, fork those repositories, create a branch with a pre-defined naming convention (i.e., prt-scan-{12-hex-chars}), inject a malicious payload into a file that's executed during CI, open a pull request, and then steal developer credentials when the workflow is triggered and publish a malicious package version if npm tokens are discovered. "Across over 450 analyzed exploit attempts, we have observed a <10% success rate," Wiz researchers said. "In most cases, successful attacks were against small hobbyist projects, and only exposed ephemeral GitHub credentials for the workflow. For the most part, this campaign did not grant the attacker access to production infrastructure, cloud credentials, or persistent API keys, barring minor exceptions." "The campaign demonstrates that while pull_request_target vulnerabilities remain exploitable at scale, modern CI/CD security practices, particularly contributor approval requirements, are effective at protecting high-profile repositories." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. SHARE     Tweet Share Share Share SHARE  Cloud security, Credential Theft, cybersecurity, DevOps, GitHub Actions, Malware, NPM, Open Source, PyPI, supply chain attack Trending News 108 Malicious Chrome Extensions Steal Google and Telegram Data, Affecting 20,000 Users Mirax Android RAT Turns Devices into SOCKS5 Proxies, Reaching 220,000 via Meta Ads New PHP Composer Flaws Enable Arbitrary Command Execution — Patches Released OpenAI Launches GPT-5.4-Cyber with Expanded Access for Security Teams Microsoft Issues Patches for SharePoint Zero-Day and 168 Other New Vulnerabilities Actively Exploited nginx-ui Flaw (CVE-2026-33032) Enables Full Nginx Server Takeover n8n Webhooks Abused Since October 2025 to Deliver Malware via Phishing Emails Cisco Patches Four Critical Identity Services, Webex Flaws Enabling Code Execution Apache ActiveMQ CVE-2026-34197 Added to CISA KEV Amid Active Exploitation Three Microsoft Defender Zero-Days Actively Exploited; Two Still Unpatched Anthropic MCP Design Vulnerability Enables RCE, Threatening AI Supply Chain Vercel Breach Tied to Context AI Hack Exposes Limited Customer Credentials Why Security Leaders Are Layering Email Defense on Top of Secure Email Gateways Why Threat Intelligence Is the Missing Link in CTEM Prioritization and Validation The Hidden Security Risks of Shadow AI in Enterprises Your MTTD Looks Great. Your Post-Alert Gap Doesn't Popular Resources Discover Key AI Security Gaps CISOs Face in 2026 Fix Rising Application Security Risks Driven by AI Development Automate Alert Triage and Investigations Across Every Threat How to Identify Risky Browser Extensions in Your Organization

Indicators of Compromise

• domain — telemetry.api-monitor.com
• domain — cjn37-uyaaa-aaaac-qgnva-cai.raw.icp0.io
• domain — pbyi76s0e9.execute-api.us-east-1.amazonaws.com
• malware — CanisterSprawl
• malware — prt-scan

Entities