CanisterWorm

Each phase of the campaign was funded by credentials stolen in the previous one. The compromised aqua-bot token enabled injection into additional Aqua repositories. Harvested npm publish tokens fueled CanisterWorm... Stolen PyPI tokens enabled the LiteLLM compromise. Stolen Checkmarx CI credentials enabled the pivot...

TeamPCP used the residual access on March 19 to push a malicious v0.69.4 tag to the Trivy repository... The commits fetched malicious Go source files from the typosquatted C2 domain scan.aquasecurtiy[.]org and fed them into the build pipeline, turning Trivy’s own release process into a malware distribution channel.

Researchers also found TeamPCP expand its operations to infect the npm ecosystem via a never-before-seen worm, called CanisterWorm, leveraging stolen publish tokens from the initial Trivy compromise.

The postinstall logic drops and launches a Python backdoor, then sets up persistence on Linux via a user-level systemd service named pgmon.

MITRE ATT&CK Mapping Technique ID Implementation Software Deployment Tools T1072 npm publish / PyPI upload abused as lateral movement and propagation

Once attackers obtain a valid npm publishing token or equivalent CI/CD access, they replace legitimate package contents with a malicious build that looks benign in version history but contains an extra postinstall hook. This hook runs automatically during npm install, so developers are infected simply by resolving dependencies, with no additional execution step.

Each phase of the campaign was funded by credentials stolen in the previous one. The compromised aqua-bot token enabled injection into additional Aqua repositories. Harvested npm publish tokens fueled CanisterWorm... Stolen PyPI tokens enabled the LiteLLM compromise. Stolen Checkmarx CI credentials enabled the pivot...

The postinstall logic drops and launches a Python backdoor, then sets up persistence on Linux via a user-level systemd service named pgmon, installed under ~/.config/systemd/user/pgmon.service.

MITRE ATT&CK Mapping Technique ID Implementation Event Triggered Execution T1546 GitHub Actions workflows triggered by push/discussion; IDE task hooks

Each phase of the campaign was funded by credentials stolen in the previous one. The compromised aqua-bot token enabled injection into additional Aqua repositories. Harvested npm publish tokens fueled CanisterWorm... Stolen PyPI tokens enabled the LiteLLM compromise. Stolen Checkmarx CI credentials enabled the pivot...

The postinstall logic drops and launches a Python backdoor, then sets up persistence on Linux via a user-level systemd service named pgmon, installed under ~/.config/systemd/user/pgmon.service.

MITRE ATT&CK Mapping Technique ID Implementation Event Triggered Execution T1546 GitHub Actions workflows triggered by push/discussion; IDE task hooks

MITRE ATT&CK Mapping Technique ID Implementation Obfuscated Files / Information T1027 AES-256-GCM encrypted payload constants; JS obfuscation; scramble()

Each phase of the campaign was funded by credentials stolen in the previous one. The compromised aqua-bot token enabled injection into additional Aqua repositories. Harvested npm publish tokens fueled CanisterWorm... Stolen PyPI tokens enabled the LiteLLM compromise. Stolen Checkmarx CI credentials enabled the pivot...

Once attackers obtain a valid npm publishing token or equivalent CI/CD access, they replace legitimate package contents with a malicious build that looks benign in version history but contains an extra postinstall hook. This hook runs automatically during npm install, so developers are infected simply by resolving dependencies, with no additional execution step.

In parallel, the JavaScript loader aggressively harvests npm credentials from multiple locations. It parses local .npmrc files in projects, the user’s ~/.npmrc, and /etc/npmrc for _authToken entries, and also inspects environment variables such as NPM_TOKEN and NPM_TOKENS.

...it allows them to steal API keys, cloud and database credentials, GitHub tokens, plus a ton of other secrets and sensitive information.

MITRE ATT&CK Mapping Technique ID Implementation Credentials from Files T1552.001 100+ filesystem hotspots across Linux/macOS/Windows

The Trivy payload’s primary objective was credential harvesting ... swept 50+ hardcoded filesystem paths for credentials: AWS configuration files, Docker Hub authentication tokens, PyPI publishing tokens, SSH keys ...

A deploy.js script uses the stolen credentials to query the npm registry search API (/-/v1/search) and enumerate all packages that the compromised user can publish.

MITRE ATT&CK Mapping Technique ID Implementation Software Deployment Tools T1072 npm publish / PyPI upload abused as lateral movement and propagation

Automated propagation via worming across software dependencies (T1210 / T1105). Deploying self-propagating malware (e.g., CanisterWorm) to spread through npm and developer workflows at scale

Harvested npm publish tokens fueled CanisterWorm, which resolved token owner identities via the npm API, enumerated all packages the compromised identity could publish to, bumped patch version numbers, and pushed malicious updates to 28 packages in under 60 seconds.

Given a single stolen npm publishing token, CanisterWorm enumerated every package within that token’s publishing scope, incremented version numbers, and inserted malicious code into new releases—completing this cycle in under 60 seconds per token.

For command and control, the backdoor repeatedly polls an Internet Computer Protocol (ICP) canister endpoint, specifically tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io, which acts as a dead-drop channel.

On Linux and macOS, the decoded Python script conducts credential collection ... exfiltrating results as tpcp.tar.gz via HTTP POST with the header X-Filename: tpcp.tar.gz to the same C2 IP address.

For command-and-control, TeamPCP employed Internet Computer Protocol (ICP) blockchain canisters—decentralized, immutable smart contracts hosted on the ICP network.

This malware uniquely leverages an ICP canister, a tamperproof smart contract on the Internet Computer blockchain, as a dead drop resolver for its command-and-control (C2) server.

Automated propagation via worming across software dependencies (T1210 / T1105). Deploying self-propagating malware (e.g., CanisterWorm) to spread through npm and developer workflows at scale

The HTTP exfiltration channel used the identifying header X-Filename: tpcp.tar.gz , which provides a reliable network detection signature for retrospective traffic analysis.

MITRE ATT&CK Mapping Technique ID Implementation Exfiltration Over Web Service T1567.002 GitHub repo commits; GitHub Actions artifacts; P2P Session network

reported a probabilistic sabotage mechanism with a 1-in-6 chance of running a recursive wipe on systems matching Israeli or Iranian locales... The original TeamPCP campaign report documented a conditional wiper... attempted to destroy data, wiping Kubernetes clusters node by node, or the local machine if no cluster was found.

Researchers have additionally observed activity involving CanisterWorm, malware that targeted Kubernetes environments and reportedly deployed destructive functionality against selected Iranian targets.