Socket Finds CanisterWorm-Style Malware in Namastex-Linked npm Packages

Apr 22, 2026 · Original article ↗

Summary

Socket reports malicious npm packages linked to Namastex’s Automagik ecosystem that steal developer secrets, browser and wallet data, and attempt propagation across npm and PyPI. The upstream cause remains unresolved.

Key points

Malicious postinstall payloads were identified in @automagik/genie versions 4.260421.33–4.260421.39 and pgserve versions 1.1.11–1.1.13, as well as releases from @fairwords and @openwebconcept.
The malware targets environment variables and files containing npm, SSH, cloud, Kubernetes, Docker, infrastructure, and other credentials, plus browser login data and crypto-wallet artifacts.
Stolen data is sent to an HTTPS webhook and an Internet Computer canister; the payload can encrypt data with AES-256-CBC and RSA-OAEP-SHA256 when a public key is available.
The malware attempts to use stolen npm tokens to inject postinstall hooks into publishable packages and republish them, and includes PyPI propagation logic using Python .pth files and Twine.
Socket reports strong overlap with prior CanisterWorm and TeamPCP-style activity, including a code reference to a TeamPCP/LiteLLM method; the canister differs from the previously documented one, and the upstream cause remains unresolved.
Recommended response includes removing affected versions, rotating potentially exposed credentials, reviewing package publish histories, hunting for the listed indicators, and comparing npm tarballs with public GitHub tags.

Article Details

Attack Vectors: Compromised npm packages execute malicious JavaScript through install-time postinstall hooks.
The payload collects secrets from environment variables and local files, including npm credentials, SSH material, cloud credentials, and .env files; it also targets browser and cryptocurrency-wallet artifacts.
Stolen data is exfiltrated through HTTPS webhook endpoints and an Internet Computer canister endpoint, with optional AES-256-CBC and RSA-OAEP-SHA256 encryption.
The malware attempts to propagate by using stolen npm publishing credentials to modify and republish packages, and by creating Python .pth payloads and uploading packages to PyPI with Twine.
Defensive Notes: Treat the identified affected package versions as malicious; block and remove them from development and CI/CD environments.
Rotate npm and GitHub tokens, cloud credentials, SSH keys, and other secrets available on systems where affected packages were installed.
Review package publishing histories and hunt internal mirrors, artifact caches, and repository history for the reported indicators and malicious postinstall patterns.
Compare npm-published tarballs with public GitHub tags and release artifacts to identify release mismatches.

Indicators of compromise

Type	Indicator	Context
SHA256	`834b6e5db5710b9308d0598978a0148a9dc832361f1fa0b7ad4343dcceba2812`	SHA-256 hash of the embedded public key file dist/public.pem found in compromised packages.
SHA256	`87259b0d1d017ad8b8daa7c177c2d9f0940e457f8dd1ab3abab3681e433ca88e`	DER SHA-256 fingerprint of the public key embedded in the malicious payload, identified as a hunt pivot.
SHA256	`c19c4574d09e60636425f9555d3b63e8cb5c9d63ceb1c982c35e5a310c97a839`	SHA-256 hash of the malicious distributed file dist/env-compat.cjs.
URL	`hxxps[:]//telemetry[.]api-monitor[.]com/v1/drop`	Malware HTTPS webhook endpoint used to exfiltrate stolen data.
URL	`hxxps[:]//telemetry[.]api-monitor[.]com/v1/telemetry`	Malware HTTPS webhook endpoint used to exfiltrate stolen data.