CanisterWorm Spreads Across 47 npm Packages After Trivy Supply-Chain Attack
Summary
Researchers report that CanisterWorm infected 47 npm packages. Its backdoor retrieves payload URLs from an ICP canister, while a newer variant harvests npm tokens during postinstall to spread. TeamPCP is suspected.
Key points
- The report identifies 47 affected npm packages following the Trivy supply-chain compromise; TeamPCP is suspected, not confirmed.
- A postinstall hook runs a loader that installs a Python backdoor, which polls an Internet Computer canister for a next-stage payload URL.
- A systemd user service masquerading as “pgmon” restarts the backdoor if it stops.
- An attacker-run deploy.js script used stolen npm tokens to publish malicious package releases; a newer variant harvests tokens during postinstall and launches propagation automatically.
- The canister can change the payload URL remotely. A youtube[.]com link acts as a dormant state, and changing the URL can arm or disarm implants.
- The newer variant was found in @teale.io/eslint-config versions 1.8.11 and 1.8.12; the article says the backdoor payload had been replaced with a test string at the time of reporting.
Article Details
- Attack Vectors
- Malicious npm package releases use a postinstall hook to execute a loader that installs a Python backdoor.
- The backdoor polls an Internet Computer canister for a URL to a next-stage executable, then fetches and runs that payload.
- A systemd user service named to resemble PostgreSQL tooling (“pgmon”) restarts the backdoor after termination.
- A newer package variant searches the developer environment for npm authentication tokens during postinstall and launches deploy.js with those tokens to publish infected packages.
MITRE ATT&CK
T1036 · MasqueradingThe persistent systemd service masquerades as PostgreSQL tooling under the name “pgmon”.T1059.006 · PythonThe Python backdoor polls the Internet Computer canister and retrieves and runs a payload URL.T1059.007 · JavaScriptA postinstall hook runs JavaScript code, including index.js and deploy.js, to install the backdoor and propagate malicious package releases.T1102.001 · Dead Drop ResolverThe malware uses an Internet Computer canister as a dead-drop resolver for the next-stage payload URL.T1105 · Ingress Tool TransferThe backdoor fetches and runs the executable referenced by the URL returned from the canister.T1195.002 · Compromise Software Supply ChainAttackers published malicious releases of compromised npm packages, including a variant that self-propagates to other packages.T1528 · Steal Application Access TokenThe newer package variant searches for npm authentication tokens in the developer environment and uses them to publish infected packages.T1543.002 · Systemd ServiceA systemd user service configured with Restart=always provides persistence for the Python backdoor.
People
Threat Actors
Malware
Products
Internet ComputerThe worm uses an Internet Computer (ICP) canister as a decentralized dead-drop for C2, allowing attackers (suspected TeamPCP) to swap payload URLs and remotely update all infected hosts.npmThreat actors behind the Trivy supply-chain compromise are conducting follow-on attacks that have infected dozens of npm packages with a self-propagating worm named CanisterWorm.TrivyThreat actors behind the Trivy supply-chain compromise are conducting follow-on attacks that have infected dozens of npm packages with a self-propagating worm named CanisterWorm.