StepSecurity Details CanisterWorm’s npm Backdoor and Self-Propagation
Summary
StepSecurity says TeamPCP used npm tokens stolen through the Trivy v0.69.4 compromise to spread CanisterWorm, which installs a persistent Python backdoor, steals npm tokens, and can deliver destructive Kubernetes payloads.
Key points
- StepSecurity reports finding matching suspicious releases across multiple npm scopes, including @opengov, and describes them as a coordinated worm deployment.
- The article links the spread to the Trivy v0.69.4 compromise, which it says exposed npm tokens in affected CI/CD pipelines.
- Compromised packages add a postinstall hook that runs code to install a Python backdoor and a persistent systemd user service without root access.
- The backdoor polls an Internet Computer-hosted C2 endpoint, tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io, about every 50 minutes for second-stage payloads.
- A separate component harvests npm tokens, finds packages those tokens can publish to, and republishes infected patch versions.
- StepSecurity says the second stage can deploy destructive Kubernetes payloads against targeted environments; the backdoor may remain active even when destructive behavior does not run.
- Recommended response includes checking for the listed host artifacts, rotating exposed tokens and other accessible secrets, reviewing outbound traffic, and pinning dependencies to clean versions.
Article Details
- Attack Vectors
- According to the article, attackers compromised Trivy release v0.69.4 and the trivy-action and setup-trivy GitHub Actions, using credential-harvesting payloads to steal CI/CD secrets, including npm tokens.
- Backdoored npm package versions add a postinstall hook that runs node index.js when the package is installed.
- A detached worm component harvests npm publishing tokens, enumerates packages those tokens can publish, then increments package versions and republishes the backdoored packages.
- The implant installs a Python backdoor and a persistent systemd user service, which polls an Internet Computer Protocol C2 endpoint and downloads second-stage binaries.
- The article reports that the second-stage payload can deploy Kubernetes DaemonSets or wipe the filesystem for targeted Iranian environments.
- Defensive Notes
- Check affected machines for ~/.local/share/pgmon/service.py and ~/.config/systemd/user/pgmon.service; the article identifies their presence as evidence of execution.
- Check for /tmp/pglog to determine whether a second-stage payload was downloaded.
- Rotate npm tokens and other secrets accessible on affected machines or in CI/CD environments during package installation.
- Review outbound network logs for connections to the reported C2 URL.
- Pin affected dependencies to the last confirmed clean version until maintainers publish remediated releases.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | scan[.]aquasecurtiy[.]org | Typosquat domain the article identifies as the Trivy-stage exfiltration endpoint. |
| URL | hxxps[:]//tdtqy-oyaaa-aaaae-af2dq-cai[.]raw[.]icp0[.]io/ | Internet Computer-hosted C2 endpoint polled by the Python implant. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe article describes the Python backdoor as base64-encoded in index.js to evade static analysis.T1041 · Exfiltration Over C2 ChannelThe compromised Trivy components exfiltrated CI/CD secrets, including npm tokens, encrypted with the attackers' RSA-4096 public key.T1059.004 · Unix ShellThe reported destructive payload runs rm -rf / --no-preserve-root on targeted non-Kubernetes systems.T1059.006 · PythonThe installed Python implant runs as service.py and polls the C2 endpoint.T1059.007 · JavaScriptThe package postinstall hook runs node index.js to launch the worm payload.T1071.001 · Web ProtocolsThe Python implant polls its C2 endpoint over the reported HTTPS URL.T1105 · Ingress Tool TransferThe implant downloads second-stage binaries from its C2 to /tmp/pglog.T1195.002 · Compromise Software Supply ChainThe attackers distributed backdoored npm package versions and compromised Trivy-related GitHub Actions to obtain credentials for further package publishing.T1485 · Data DestructionThe article reports filesystem deletion, including a Kubernetes DaemonSet that deletes host filesystems and a non-Kubernetes rm -rf payload.T1543.002 · Systemd ServiceThe implant creates a systemd user service configured to restart automatically and persist across logins and reboots.T1552.001 · Credentials In FilesThe worm reads npm authentication tokens from user and project .npmrc files.
Threat Actors
Malware
Vendors
Products
GitHub Actionsto the typosquat domain scan.aquasecurtiy.org. They also compromised the trivy-action and setup-trivy GitHub Actions, embedding credential-harvesting payloads that read CI/CD environment variables and runner processKubernetesit can reach, continuing the spread. A second-stage payload delivered via the C2 carries destructive Kubernetes capabilities and filesystem wipe logic for geopolitically targeted victims.npmTrivy's compromise, StepSecurity's AI Package Analyst flagged suspicious new releases across multiple npm scopes — revealing CanisterWorm, a self-propagating npm worm deployed by the TeamPCP threat actor. The worm