CanisterSprawl Worm Uses Stolen npm Tokens to Spread Through Compromised Packages
Summary
Socket and StepSecurity report CanisterSprawl, a worm that steals developer secrets and npm tokens to spread poisoned packages. The article also covers compromised xinference releases and the prt-scan campaign targeting GitHub Actions.
Key points
- CanisterSprawl uses malicious postinstall hooks in compromised npm packages to steal developer credentials and use npm tokens to publish further poisoned releases.
- Affected npm packages include @automagik/genie, @fairwords/loopback-connector-es, @fairwords/websocket, @openwebconcept/design-tokens, @openwebconcept/theme-owc, and pgserve.
- The malware targets secrets including SSH keys, cloud credentials, Kubernetes and Docker configurations, and local .env files; it sends stolen data to a webhook and an ICP canister.
- The worm includes PyPI propagation logic that can create and upload malicious Python packages when the necessary credentials are available.
- JFrog reported compromised xinference versions 2.6.0–2.6.2 containing a credential-harvesting payload. TeamPCP disputed responsibility and said a copycat was behind it.
- Wiz reported over 450 analyzed prt-scan exploit attempts targeting GitHub Actions pull_request_target workflows, with a success rate below 10%; most successful cases involved small hobbyist projects and ephemeral workflow credentials.
Article Details
- Event Type
- Self-propagating software supply-chain attack using compromised npm packages and stolen developer tokens
- Impact
- The reported CanisterSprawl worm stole developer secrets and npm tokens through malicious postinstall hooks, then used the tokens to publish poisoned package versions and spread. It also contained logic to publish malicious PyPI packages when credentials were available. The article identifies six affected npm packages and describes exfiltration to an HTTPS webhook and an ICP canister. Separately, JFrog reported compromised xinference versions, while TeamPCP disputed responsibility and claimed a copycat was behind that compromise.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| HOSTNAME | cjn37-uyaaa-aaaac-qgnva-cai[.]raw[.]icp0[.]io | ICP canister host identified as an endpoint used by CanisterSprawl to exfiltrate stolen information. |
| HOSTNAME | pbyi76s0e9[.]execute-api[.]us-east-1[.]amazonaws[.]com | AWS API Gateway endpoint reported as an exfiltration destination for credentials stolen by the Asurion-impersonation packages. |
| HOSTNAME | telemetry[.]api-monitor[.]com | Webhook identified as an endpoint used by CanisterSprawl to exfiltrate stolen developer information. |
MITRE ATT&CK
People
Threat Actors
420tbNamed GitHub account under which the prt-scan attacker was reported to operate while targeting repositories using the pull_request_target workflow trigger.69tf420Named GitHub account under which the prt-scan attacker was reported to operate while targeting repositories using the pull_request_target workflow trigger.beforetested-boopNamed GitHub account under which the prt-scan attacker was reported to operate while targeting repositories using the pull_request_target workflow trigger.elzoteboNamed GitHub account under which the prt-scan attacker was reported to operate while targeting repositories using the pull_request_target workflow trigger.ezmteboNamed GitHub account under which the prt-scan attacker was reported to operate while targeting repositories using the pull_request_target workflow trigger.TeamPCPThe xinference payload reportedly included a '# hacked by teampcp' marker associated with recent TeamPCP compromises. TeamPCP disputed responsibility for the xinference compromise and claimed it was the work of a copycat.testedbeforeNamed GitHub account under which the prt-scan attacker was reported to operate while targeting repositories using the pull_request_target workflow trigger.
Malware
CanisterSprawlResearchers have flagged a supply-chain worm dubbed CanisterSprawl that uses compromised npm packages and stolen developer npm tokens to push poisoned releases and self-propagate via malicious postinstall hooks.CanisterWormto the use of an ICP canister to exfiltrate the stolen data, in a tactic reminiscent of TeamPCP’s CanisterWorm to make the infrastructure resilient to takedowns.
Products
GitHub ActionsPyPI propagation logic, and sits alongside other attacks like xinference compromises and the prt-scan GitHub Actions exploit.npmResearchers have flagged a supply-chain worm dubbed CanisterSprawl that uses compromised npm packages and stolen developer npm tokens to push poisoned releases and self-propagate via malicious postinstall hooks.PyPIThe campaign exfiltrates extensive developer secrets to an HTTPS webhook and an ICP canister, includes PyPI propagation logic, and sits alongside other attacks like xinference compromises and the prt-scan GitHub Actions