Cybersecurity researchers have flagged a fresh set of packages that have been compromised by bad actors to deliver a self-propagating worm that spreads through stolen developer npm tokens.
The supply chain worm has been detected by both Socket and StepSecurity, with the companies tracking the activity under the name CanisterSprawl owing to the use of an ICP canister to exfiltrate the stolen data, in a tactic reminiscent of TeamPCP’s CanisterWorm to make the infrastructure resilient to takedowns.
The list of affected packages is below –
- @automagik/genie (4.260421.33 – 4.260421.40)
- @fairwords/loopback-connector-es (1.4.3 – 1.4.4)
- @fairwords/websocket (1.0.38 – 1.0.39)
- @openwebconcept/design-tokens (1.0.1 – 1.0.3)
- @openwebconcept/theme-owc (1.0.1 – 1.0.3)
- pgserve (1.1.11 – 1.1.14)
The malware is triggered during install time via a postinstall hook to steal credentials and secrets from developer environments, and then leverage the stolen npm tokens to push poisoned versions of the packages to the registry with a new malicious postinstall hook so as to expand the reach of the campaign.
Captured information includes –
- .npmrc
- SSH keys and SSH configurations
- .git-credentials
- .netrc
- cloud credentials for Amazon Web Services, Google Cloud, and Microsoft Azure
- Kubernetes and Docker configurations
- Terraform, Pulumi, and Vault material
- Database password files
- Local .env* files
- Shell history files
In addition, it attempts to access credentials from Chromium-based web browsers and data associated with cryptocurrency wallet extension apps. The information is exfiltrated to an HTTPS webhook (“telemetry.api-monitor[.]com”) and an ICP canister (“cjn37-uyaaa-aaaac-qgnva-cai.raw.icp0[.]io”).
“It also contains PyPI propagation logic,” Socket said. “The script generates a Python .pth-based payload designed to execute when Python starts, then prepares and uploads malicious Python packages with Twine if the required credentials are present.”
“In other words, this is not just a credential stealer. It is designed to turn one compromised developer environment into additional package compromises.”
The disclosure comes as JFrog revealed that multiple versions of the legitimate Python package “xinference” (2.6.0, 2.6.1, and 2.6.2) have been compromised to include a Base64-encoded payload that fetches a second-stage collector module responsible for harvesting a wide range of credentials and secrets from the infected host
“The decoded payload opens with the comment ‘# hacked by teampcp,’ the same actor marker seen in recent TeamPCP compromises,” the company said. However, in a post shared on X, TeamPCP disputedthey were behind the compromise and claimed it was the work of a copycat.
Attacks Target npm and PyPI
The findings are the latest additions to a long list of attacks that have targeted the open-source ecosystem. This includes two malicious packages, each on npm (kube-health-tools) and PyPI (kube-node-health), that masquerade as Kubernetes utilities, but silently install a Go-based binary to establish a SOCKS5 proxy, a reverse proxy, an SFTP server, and a large language model (LLM) proxy on the victim’s machine.
The LLM proxy is an OpenAI-compatible API gateway that accepts requests and routes them to upstream APIs, including Chinese LLM routers like shubiaobiao.
“Beyond providing cheap access to AI, LLM routers like the one deployed here sit on a trust boundary that is easily abused,” Aikido Security researcher Ilyas Makari said. “Because every request passes through the router in plaintext, a malicious operator can […] inject malicious tool calls into responses of coding agents before they reach the client, introducing malicious pip install or curl | bash payloads mid-flight.”
Alternatively, the router can be used to exfiltrate secrets from request and response bodies, including API keys, AWS credentials, GitHub tokens, Ethereum private keys, and system prompts.
Another sustained npm supply chain attack campaign documented by Panther has impersonated phone insurance provider Asurion and its subsidiaries, publishing malicious packages (sbxapps, asurion-hub-web, soluto-home-web, and asurion-core) from April 1 through April 8, 2026, containing a multi-stage credential harvester.
The stolen credentials were exfiltrated initially to a Slack webhook and then to an AWS API Gateway endpoint (“pbyi76s0e9.execute-api.us-east-1.amazonaws[.]com”). By April 7, the AWS exfiltration URL is said to have been obfuscated using XOR encoding.
Last but not least, Google-owned cloud security firm Wiz shed light on an artificial intelligence (AI)-powered campaign dubbed prt-scan that has systematically exploited the “pull_request_target” GitHub Actions workflow trigger since March 11, 2026, to steal developer secrets.
The attacker, operating under the accounts testedbefore, beforetested-boop, 420tb, 69tf420, elzotebo, and ezmtebo, has been found to search for repositories using the trigger, fork those repositories, create a branch with a pre-defined naming convention (i.e., prt-scan-{12-hex-chars}), inject a malicious payload into a file that’s executed during CI, open a pull request, and then steal developer credentials when the workflow is triggered and publish a malicious package version if npm tokens are discovered.
“Across over 450 analyzed exploit attempts, we have observed a <10% success rate," Wiz researchers said. "In most cases, successful attacks were against small hobbyist projects, and only exposed ephemeral GitHub credentials for the workflow. For the most part, this campaign did not grant the attacker access to production infrastructure, cloud credentials, or persistent API keys, barring minor exceptions."
“The campaign demonstrates that while pull_request_target vulnerabilities remain exploitable at scale, modern CI/CD security practices, particularly contributor approval requirements, are effective at protecting high-profile repositories.”
