{"id":11537,"date":"2026-03-23T10:03:44","date_gmt":"2026-03-23T10:03:44","guid":{"rendered":"https:\/\/serisec.com\/index.php\/2026\/03\/23\/new-canisterworm-steals-npm-tokens-and-spreads-through-compromised-publisher-accounts\/"},"modified":"2026-03-23T10:03:44","modified_gmt":"2026-03-23T10:03:44","slug":"new-canisterworm-steals-npm-tokens-and-spreads-through-compromised-publisher-accounts","status":"publish","type":"post","link":"https:\/\/serisec.com\/index.php\/2026\/03\/23\/new-canisterworm-steals-npm-tokens-and-spreads-through-compromised-publisher-accounts\/","title":{"rendered":"New CanisterWorm Steals npm Tokens and Spreads Through Compromised Publisher Accounts"},"content":{"rendered":"

New CanisterWorm Steals npm Tokens and Spreads Through Compromised Publisher Accounts
\n \t

\n
<\/BR>
\n
\n \t

\n
<\/BR><\/p>\n

\n

A new wave of supply chain attacks is hitting the npm ecosystem through a self-propagating malware campaign known as CanisterWorm. <\/p>\n

The threat, linked to a group tracked as \u201cTeamPCP,\u201d compromises legitimate publisher namespaces and pushes poisoned package versions, effectively turning trusted developer tools into silent delivery mechanisms for credential-stealing code.<\/a><\/p>\n

CanisterWorm first came to public attention through early reports from security researchers at Socket and Endor Labs, who traced a recurring pattern of malicious package updates across multiple npm publisher accounts. <\/p>\n

The malware is carefully concealed inside what appear to be routine SDK version bumps, making it easy for developers to install it without raising any suspicion.<\/a><\/p>\n

JFrog researchers identified new, previously unreported compromised package<\/a> versions tied to the CanisterWorm attack, extending the known scope of the campaign well beyond what earlier disclosures had covered. <\/p>\n

Their continuous monitoring pipeline surfaced additional affected versions across multiple namespaces \u2014 including packages maintained under\u00a0@emilgroup<\/code>\u00a0and\u00a0@teale.io<\/code>\u00a0\u2014 that had gone undetected in prior public reports.<\/a><\/p>\n

The impact of a successful infection goes far beyond a single machine. Once a developer installs one of the tainted packages, CanisterWorm drops a Python backdoor<\/a> onto the host, begins harvesting npm authentication tokens, and uses those credentials to autonomously spread itself to every package the compromised developer maintains. <\/p>\n

This chain-reaction behavior means one affected developer account can become a launchpad for poisoning dozens of downstream packages, putting a wide range of dependent projects and their users at immediate risk.<\/a><\/p>\n

What makes CanisterWorm particularly difficult to contain is how naturally it blends into normal development workflows. <\/p>\n

By hiding behind version updates and leveraging decentralized infrastructure for command communication, it sidesteps the traditional indicators that most security tools<\/a> look for, quietly expanding its reach before anyone notices something is wrong.<\/a><\/p>\n

Inside the Worm\u2019s Infection Chain<\/strong><\/h2>\n

The infection process begins the moment a developer runs\u00a0npm install<\/code>\u00a0on a compromised package. <\/p>\n

A malicious\u00a0postinstall<\/code>\u00a0hook embedded inside the\u00a0package.json<\/code>\u00a0file executes automatically and silently drops a Python backdoor onto the host system without any visible warning. <\/p>\n

On Linux machines, the worm then registers a persistent background service named\u00a0pgmon<\/code>\u00a0through\u00a0systemd<\/code>, ensuring it stays active and survives system reboots.<\/p>\n

Once established, the backdoor continuously polls an Internet Computer Protocol (ICP) canister \u2014 a decentralized, blockchain-hosted endpoint \u2014 that acts as a dead-drop command-and-control server. <\/p>\n

This design makes the malicious traffic blend naturally with regular web requests, significantly hampering detection by network monitoring tools<\/a>. <\/p>\n

Secondary payloads retrieved through this channel are written to\u00a0\/tmp\/pglog<\/code>, while the worm tracks its execution state inside\u00a0\/tmp\/.pg_state<\/code>.<\/a><\/p>\n

The most dangerous phase of the attack is the autonomous spreading routine. The malware scans\u00a0.npmrc<\/code>\u00a0files across the project directory, the user\u2019s home folder, and system-wide configuration paths, searching for\u00a0_authToken<\/code>\u00a0values. <\/p>\n

It also reads the\u00a0NPM_TOKEN<\/code>\u00a0and\u00a0NPM_TOKENS<\/code>\u00a0environment variables. With those stolen credentials, a built-in\u00a0deploy.js<\/code>\u00a0script queries the npm registry, locates every package the victim maintains, increments each one\u2019s patch version number, and publishes the tainted update automatically.<\/p>\n

Known Compromised Packages:-<\/p>\n

\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n\n
Package Name<\/th>\nCompromised Version(s)<\/th>\nJFrog X-ray ID<\/th>\n<\/tr>\n<\/thead>\n
@pypestream\/floating-ui-dom<\/code><\/td>\n2.15.1<\/td>\nXRAY-955001<\/td>\n<\/tr>\n
@leafnoise\/mirage<\/code><\/td>\n2.0.3<\/td>\nXRAY-954938<\/td>\n<\/tr>\n
@opengov\/ppf-backend-types<\/code><\/td>\n1.141.2<\/td>\nXRAY-954962<\/td>\n<\/tr>\n
eslint-config-ppf<\/code><\/td>\n0.128.2<\/td>\nXRAY-954936<\/td>\n<\/tr>\n
react-leaflet-marker-layer<\/code><\/td>\n0.1.5<\/td>\nXRAY-954942<\/td>\n<\/tr>\n
react-leaflet-cluster-layer<\/code><\/td>\n0.0.4<\/td>\nXRAY-954943<\/td>\n<\/tr>\n
react-autolink-text<\/code><\/td>\n2.0.1<\/td>\nXRAY-954959<\/td>\n<\/tr>\n
opengov-k6-core<\/code><\/td>\n1.0.2<\/td>\nXRAY-954926<\/td>\n<\/tr>\n
jest-preset-ppf<\/code><\/td>\n0.0.2<\/td>\nXRAY-954956<\/td>\n<\/tr>\n
cit-playwright-tests<\/code><\/td>\n1.0.1<\/td>\nXRAY-954934<\/td>\n<\/tr>\n
eslint-config-service-users<\/code><\/td>\n0.0.3<\/td>\nXRAY-954950<\/td>\n<\/tr>\n
babel-plugin-react-pure-component<\/code><\/td>\n0.1.6<\/td>\nXRAY-954955<\/td>\n<\/tr>\n
@opengov\/form-renderer<\/code><\/td>\n0.2.20<\/td>\nXRAY-955058<\/td>\n<\/tr>\n
@opengov\/qa-record-types-api<\/code><\/td>\n1.0.3<\/td>\nXRAY-954970<\/td>\n<\/tr>\n
@opengov\/form-builder<\/code><\/td>\n0.12.3<\/td>\nXRAY-954953<\/td>\n<\/tr>\n
@opengov\/ppf-eslint-config<\/code><\/td>\n0.1.11<\/td>\nXRAY-954967<\/td>\n<\/tr>\n
@opengov\/form-utils<\/code><\/td>\n0.7.2<\/td>\nXRAY-954958<\/td>\n<\/tr>\n
react-leaflet-heatmap-layer<\/code><\/td>\n2.0.1<\/td>\nXRAY-954931<\/td>\n<\/tr>\n
@virtahealth\/substrate-root<\/code><\/td>\n1.0.1<\/td>\nXRAY-955055<\/td>\n<\/tr>\n
@airtm\/uuid-base32<\/code><\/td>\n1.0.2<\/td>\nXRAY-954937<\/td>\n<\/tr>\n
@emilgroup\/setting-sdk<\/code><\/td>\n0.2.3, 0.2.2, 0.2.1<\/td>\nXRAY-955067<\/td>\n<\/tr>\n
@emilgroup\/partner-portal-sdk<\/code><\/td>\n1.1.3, 1.1.2, 1.1.1<\/td>\nXRAY-955063<\/td>\n<\/tr>\n
@emilgroup\/gdv-sdk-node<\/code><\/td>\n2.6.3, 2.6.2, 2.6.1<\/td>\nXRAY-955060<\/td>\n<\/tr>\n
@emilgroup\/docxtemplater-util<\/code><\/td>\n1.1.4, 1.1.3, 1.1.2<\/td>\nXRAY-955062<\/td>\n<\/tr>\n
@emilgroup\/accounting-sdk<\/code><\/td>\n1.27.3, 1.27.2, 1.27.1<\/td>\nXRAY-955054<\/td>\n<\/tr>\n
@emilgroup\/task-sdk<\/code><\/td>\n1.0.4, 1.0.3, 1.0.2<\/td>\nXRAY-955056<\/td>\n<\/tr>\n
@emilgroup\/setting-sdk-node<\/code><\/td>\n0.2.3, 0.2.2, 0.2.1<\/td>\nXRAY-955064<\/td>\n<\/tr>\n
@emilgroup\/task-sdk-node<\/code><\/td>\n1.0.4, 1.0.3, 1.0.2<\/td>\nXRAY-954923<\/td>\n<\/tr>\n
@emilgroup\/partner-sdk<\/code><\/td>\n1.19.3, 1.19.2, 1.19.1<\/td>\nXRAY-955065<\/td>\n<\/tr>\n
@emilgroup\/numbergenerator-sdk-node<\/code><\/td>\n1.3.3, 1.3.2, 1.3.1<\/td>\nXRAY-955066<\/td>\n<\/tr>\n
@emilgroup\/customer-sdk<\/code><\/td>\n1.54.5, 1.54.4, 1.54.3, 1.54.2, 1.54.1<\/td>\nXRAY-954924<\/td>\n<\/tr>\n
@emilgroup\/commission-sdk<\/code><\/td>\n1.0.3, 1.0.2, 1.0.1<\/td>\nXRAY-955068<\/td>\n<\/tr>\n
@emilgroup\/process-manager-sdk<\/code><\/td>\n1.4.2, 1.4.1<\/td>\nXRAY-955069<\/td>\n<\/tr>\n
@emilgroup\/changelog-sdk-node<\/code><\/td>\n1.0.3, 1.0.2<\/td>\nXRAY-955061<\/td>\n<\/tr>\n
@emilgroup\/document-sdk-node<\/code><\/td>\n1.43.6, 1.43.5, 1.43.4, 1.43.3, 1.43.2, 1.43.1<\/td>\nXRAY-954947<\/td>\n<\/tr>\n
@emilgroup\/commission-sdk-node<\/code><\/td>\n1.0.3, 1.0.2, 1.0.1<\/td>\nXRAY-955053<\/td>\n<\/tr>\n
@emilgroup\/document-uploader<\/code><\/td>\n0.0.12, 0.0.11, 0.0.10<\/td>\nXRAY-955057<\/td>\n<\/tr>\n
@emilgroup\/discount-sdk<\/code><\/td>\n1.5.3, 1.5.2, 1.5.1<\/td>\nXRAY-954929<\/td>\n<\/tr>\n
@emilgroup\/discount-sdk-node<\/code><\/td>\n1.5.2, 1.5.1<\/td>\nXRAY-955059<\/td>\n<\/tr>\n
@teale.io\/eslint-config<\/code><\/td>\n1.8.16\u20131.8.9 (8 versions)<\/td>\nXRAY-954945<\/td>\n<\/tr>\n
@emilgroup\/insurance-sdk<\/code><\/td>\n1.97.6\u20131.97.1 (6 versions)<\/td>\nXRAY-954928<\/td>\n<\/tr>\n
@emilgroup\/account-sdk<\/code><\/td>\n1.41.2, 1.41.1<\/td>\nXRAY-954949<\/td>\n<\/tr>\n
@emilgroup\/account-sdk-node<\/code><\/td>\n1.40.2, 1.40.1<\/td>\nXRAY-954927<\/td>\n<\/tr>\n
@emilgroup\/accounting-sdk-node<\/code><\/td>\n1.26.2, 1.26.1<\/td>\nXRAY-954965<\/td>\n<\/tr>\n
@emilgroup\/api-documentation<\/code><\/td>\n1.19.2, 1.19.1<\/td>\nXRAY-954960<\/td>\n<\/tr>\n
@emilgroup\/auth-sdk<\/code><\/td>\n1.25.2, 1.25.1<\/td>\nXRAY-954966<\/td>\n<\/tr>\n
@emilgroup\/auth-sdk-node<\/code><\/td>\n1.21.2, 1.21.1<\/td>\nXRAY-954964<\/td>\n<\/tr>\n
@emilgroup\/billing-sdk<\/code><\/td>\n1.56.2, 1.56.1<\/td>\nXRAY-954951<\/td>\n<\/tr>\n
@emilgroup\/billing-sdk-node<\/code><\/td>\n1.57.2, 1.57.1<\/td>\nXRAY-954948<\/td>\n<\/tr>\n
@emilgroup\/claim-sdk<\/code><\/td>\n1.41.2, 1.41.1<\/td>\nXRAY-954961<\/td>\n<\/tr>\n
@emilgroup\/claim-sdk-node<\/code><\/td>\n1.39.2, 1.39.1<\/td>\nXRAY-954925<\/td>\n<\/tr>\n
@emilgroup\/customer-sdk-node<\/code><\/td>\n1.55.2, 1.55.1<\/td>\nXRAY-954944<\/td>\n<\/tr>\n
@emilgroup\/document-sdk<\/code><\/td>\n1.45.2, 1.45.1<\/td>\nXRAY-954941<\/td>\n<\/tr>\n
@emilgroup\/gdv-sdk<\/code><\/td>\n2.6.2, 2.6.1<\/td>\nXRAY-954930<\/td>\n<\/tr>\n
@emilgroup\/insurance-sdk-node<\/code><\/td>\n1.95.2, 1.95.1<\/td>\nXRAY-954933<\/td>\n<\/tr>\n
@emilgroup\/notification-sdk-node<\/code><\/td>\n1.4.2, 1.4.1<\/td>\nXRAY-954957<\/td>\n<\/tr>\n
@emilgroup\/partner-portal-sdk-node<\/code><\/td>\n1.1.2, 1.1.1<\/td>\nXRAY-954952<\/td>\n<\/tr>\n
@emilgroup\/partner-sdk-node<\/code><\/td>\n1.19.2, 1.19.1<\/td>\nXRAY-954935<\/td>\n<\/tr>\n
@emilgroup\/payment-sdk<\/code><\/td>\n1.15.2, 1.15.1<\/td>\nXRAY-954963<\/td>\n<\/tr>\n
@emilgroup\/payment-sdk-node<\/code><\/td>\n1.23.2, 1.23.1<\/td>\nXRAY-954969<\/td>\n<\/tr>\n
@emilgroup\/process-manager-sdk-node<\/code><\/td>\n1.13.2, 1.13.1<\/td>\nXRAY-954939<\/td>\n<\/tr>\n
@emilgroup\/public-api-sdk<\/code><\/td>\n1.33.2, 1.33.1<\/td>\nXRAY-954940<\/td>\n<\/tr>\n
@emilgroup\/public-api-sdk-node<\/code><\/td>\n1.35.2, 1.35.1<\/td>\nXRAY-954946<\/td>\n<\/tr>\n
@emilgroup\/tenant-sdk<\/code><\/td>\n1.34.2, 1.34.1<\/td>\nXRAY-954932<\/td>\n<\/tr>\n
@emilgroup\/tenant-sdk-node<\/code><\/td>\n1.33.2, 1.33.1<\/td>\nXRAY-954954<\/td>\n<\/tr>\n
@emilgroup\/translation-sdk-node<\/code><\/td>\n1.1.2, 1.1.1<\/td>\nXRAY-954968<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/figure>\n

<\/a><\/p>\n

Anyone running any of the identified compromised package versions should treat their environment as already infected. Developers must immediately rotate all npm publishing tokens stored in\u00a0.npmrc<\/code>\u00a0files, environment variables, and CI\/CD pipeline secrets. <\/p>\n

On Linux, the\u00a0pgmon<\/code>\u00a0service must be stopped and disabled using\u00a0systemctl<\/code>, with its associated service files and directories removed entirely. <\/p>\n

The temporary files\u00a0\/tmp\/pglog<\/code>\u00a0and\u00a0\/tmp\/.pg_state<\/code>\u00a0must be deleted. Affected\u00a0node_modules<\/code>\u00a0directories should be purged and rebuilt from scratch using verified, safe package versions. <\/p>\n

Developers whose tokens were stolen must manually unpublish the compromised package versions from the npm registry, since simply publishing a newer version does not protect downstream users who may still install the infected release. <\/p>\n

Running\u00a0npm config set ignore-scripts true<\/code>\u00a0globally prevents\u00a0postinstall<\/code>\u00a0hooks from firing silently on future installs, serving as a practical defensive measure against this class of supply chain attack.<\/a><\/p>\n

Follow us on\u00a0Google News<\/a>,\u00a0LinkedIn<\/a>,\u00a0and\u00a0X<\/a>\u00a0to Get More Instant Updates<\/strong>,\u00a0Set CSN as a Preferred Source in\u00a0Google<\/a>.<\/strong><\/p>\n

The post New CanisterWorm Steals npm Tokens and Spreads Through Compromised Publisher Accounts<\/a> appeared first on Cyber Security News<\/a>.<\/p>\n<\/div>\n

\t

\n
<\/BR>
\n Tushar Subhra Dutta
\n \t

\n
<\/BR>
\nGo to cyber-security-news<\/a>
\n \t

\n
<\/BR><\/p>\n","protected":false},"excerpt":{"rendered":"

New CanisterWorm Steals npm Tokens and Spreads Through Compromised Publisher Accounts A new wave of supply chain attacks is hitting the npm ecosystem through a self-propagating malware campaign known as CanisterWorm. The threat, linked to a group tracked as \u201cTeamPCP,\u201d compromises legitimate publisher namespaces and pushes poisoned package versions, effectively turning trusted developer tools into […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[129,63,649],"tags":[130],"class_list":["post-11537","post","type-post","status-publish","format-standard","hentry","category-cyber-security","category-cyber-security-news","category-threats","tag-cyber-security-news"],"_links":{"self":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11537"}],"collection":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/comments?post=11537"}],"version-history":[{"count":0,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/posts\/11537\/revisions"}],"wp:attachment":[{"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/media?parent=11537"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/categories?post=11537"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/serisec.com\/index.php\/wp-json\/wp\/v2\/tags?post=11537"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}