Self-Propagating Supply-Chain Worm Compromises npm Packages to Harvest Developer Tokens
Security teams have identified a cluster of npm packages that were tampered with to deliver a self-replicating supply-chain worm which leverages stolen developer npm tokens to spread. The activity, tracked by Socket and StepSecurity, has been labeled “CanisterSprawl” because the attackers use an ICP canister as one of the exfiltration sinks - a resilience tactic similar to the previously observed CanisterWorm attributed to TeamPCP.
The compromised packages and the affected version ranges are:
- @automagik/genie (4.260421.33 – 4.260421.40)
- @fairwords/loopback-connector-es (1.4.3 – 1.4.4)
- @fairwords/websocket (1.0.38 – 1.0.39)
- @openwebconcept/design-tokens (1.0.1 – 1.0.3)
- @openwebconcept/theme-owc (1.0.1 – 1.0.3)
- pgserve (1.1.11 – 1.1.14)
Infection happens during package installation: a malicious postinstall hook executes and scavenges credentials and secrets from the developer’s environment. If it finds valid npm tokens, the malware uses them to publish altered package versions to the registry, each carrying a new postinstall hook so the compromise can propagate to other developers who install the packages.
The types of data the malware collects include configuration and credential files such as:
- .npmrc
- SSH private keys and SSH configuration files
- .git-credentials
- .netrc
- Cloud provider credentials for Amazon Web Services, Google Cloud, and Microsoft Azure
- Kubernetes and Docker config files
- Infrastructure-as-code and secret manager material (Terraform, Pulumi, Vault)
- Database password files
- Local .env* files
- Shell history files
Beyond those artifacts, the malicious code also attempts to extract secrets stored in Chromium-based browsers and data from cryptocurrency wallet extensions. Stolen data is sent to an HTTPS webhook at telemetry.api-monitor[.]com and to an Internet Computer Protocol (ICP) canister at cjn37-uyaaa-aaaac-qgnva-cai.raw.icp0[.]io.