Loading malware…
CanisterWorm is a self-propagating malware family associated with the financially motivated threat actor TeamPCP, also tracked by some organizations as UNC6780. It emerged during the March 2026 software supply-chain campaign that followed the compromise of CI/CD environments and package publishing credentials. The malware is best known for abusing stolen npm publish tokens to automatically identify packages a victim could publish, increment package versions, and republish trojanized updates at high speed across numerous npm packages and publisher scopes.
A defining characteristic of CanisterWorm is its use of Internet Computer Protocol canisters as decentralized command-and-control or dead-drop resolver infrastructure, an approach intended to complicate conventional takedown efforts. Variants polled the canister periodically to retrieve the active payload location and included logic to suspend activity under certain kill-switch conditions. In developer and Linux environments, CanisterWorm established persistence by masquerading as benign services and utilities, including systemd-backed components. Reported variants also preserved legitimate package content and metadata while injecting malicious install-time logic, helping poisoned releases appear authentic to downstream users.
CanisterWorm’s core function is credential theft and propagation. It searched compromised environments for npm authentication material, resolved publisher identities through package registry APIs, enumerated packages available to the compromised account, and pushed malicious updates automatically. Beyond npm propagation, some observed variants expanded into Kubernetes and broader post-compromise activity. These variants deployed privileged workloads in clusters, attempted cluster-wide propagation, and on non-targeted systems installed persistence mechanisms rather than immediately destroying data.
The malware family is also linked to destructive behavior. A conditional wiper component checked for indicators associated with Iranian systems, including Tehran timezone and Persian-language settings. When those conditions matched, the malware attempted recursive file deletion on standalone hosts or used privileged Kubernetes DaemonSet-style deployment for cluster-wide destruction. On systems not matching those conditions, observed behavior favored persistence and continued access.
CanisterWorm primarily affected Linux-based developer and containerized environments, especially CI/CD runners and Kubernetes clusters, while its supply-chain propagation targeted the npm ecosystem. It formed part of a broader TeamPCP intrusion chain in which credentials stolen from earlier compromises were reused to expand access, distribute additional malicious packages, and support downstream exploitation, persistence, and destructive operations.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Initial Access: Exploiting public-facing applications (e.g., React2Shell) and exposed APIs (Docker, Kubernetes, Redis, Ray dashboards).
CVE-2026-33634 (CVSS4B 9.4, Critical) has been assigned to the Trivy ecosystem compromise and was added to CISA's Known Exploited Vulnerabilities Catalog on March 26, 2026.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182.
Aikido Security - TeamPCP deploys CanisterWorm on NPM ... CanisterWorm — Self-propagating worm using ICP Canister for C2 ... File System Indicators /tmp/pglog (CanisterWorm payload drop path)
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
By March 20, the group had also deployed CanisterWorm: a self-propagating npm worm that spread across more than 47 npm packages spanning multiple publisher scopes.
29 distinct techniques documented for this family, organized by ATT&CK tactic.
attackers used the residual service account token to force-push 76 of 77 version tags in the aquasecurity/trivy-action repository
autonomously publishes the malware to every package the victim has publish rights to—transforming each victim into a propagation vector
The threat actor known as TeamPCP orchestrated a four-wave supply chain campaign between March 19–24, 2026, compromising Trivy, Checkmarx KICS/AST GitHub Actions, and LiteLLM.
The group’s defining operational signature is indirect initial access: rather than attacking target organizations directly, TeamPCP compromises widely trusted open-source security and developer tooling that those organizations already run in their build environments, then harvests the elevated secrets that CI/CD pipelines must hold to function.
Its corresponding GitHub Action — aquasecurity/trivy-action — was referenced by downstream workflows using mutable version tags rather than pinned commit hashes, meaning that any attacker who could push a new commit and update those tags would instantly reach every pipeline that ran a Trivy scan on subsequent executions.
Persistence: Achieving persistence through scheduled tasks/cron (systemd services) and deploying containers.
Execution: Utilizing command and scripting interpreters (Shell, Python) and container administration commands.
the malware writes a Python dropper to ~/.config/systemd/user/sysmon.py... a base64-encoded Python filesystem harvester
Persistence: Achieving persistence through scheduled tasks/cron (systemd services) and deploying containers.
the malware uses passwordless sudo to dump Runner.Worker process memory via /proc/[pid]/mem, parsing readable memory regions and searching for {"value":"<secret>","isSecret":true}
attackers used the residual service account token to force-push 76 of 77 version tags in the aquasecurity/trivy-action repository
CanisterWorm was observed using the ICP canister C2 infrastructure to propagate across Kubernetes environments, masquerading as systemd services and the PostgreSQL utility pgmon
the malware uses passwordless sudo to dump Runner.Worker process memory via /proc/[pid]/mem, parsing readable memory regions and searching for {"value":"<secret>","isSecret":true}
attackers used the residual service account token to force-push 76 of 77 version tags in the aquasecurity/trivy-action repository
Stolen npm tokens triggered CanisterWorm, a self-propagating worm infecting 47+ packages... harvesting tokens from ~/.npmrc, environment variables, and npm config
Credential Harvesting: Collecting credentials from files (.env, SSH keys, Git credentials, cloud secrets) and stealing application access tokens.
The backdoor polls this endpoint every approximately 50 minutes using a spoofed browser User-Agent string.
Command and Control: Establishing C2 via proxies (FRPS, GOST, P2P relays), application layer protocols, and encrypted channels (Sliver C2 framework).
The worm uses an ICP (Internet Computer Protocol) canister as a decentralised dead-drop resolver for C2
After a 5-minute sleep, it polls an ICP canister... every ~50 minutes. The canister returns a URL pointing to the next-stage payload.
99 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
109 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A self-propagating npm worm that harvested npm tokens from compromised environments, authenticated to npm, enumerated publishable packages, bumped package versions, and republished malicious packages. Its payload chain installed a persistent Python backdoor via systemd and polled an ICP canister for updated payloads.
Self-propagating malware used in TeamPCP supply chain attacks to steal cloud credentials, API keys, SSH keys, and Kubernetes secrets.
Credential-stealing malware used to harvest cloud access tokens, credentials, and API keys from AWS, GCP, and Azure environments.
Credential-stealing malware used to harvest cloud access tokens, credentials, and API keys from AWS, GCP, and Azure environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.