Loading malware…
CanisterWorm is a self-propagating supply-chain worm associated with the financially motivated threat actor TeamPCP. It emerged during the 2026 TeamPCP campaign that compromised trusted developer and security tooling and then reused stolen publishing credentials to spread through software package ecosystems. The malware is notable for using Internet Computer Protocol canister infrastructure as a resilient dead-drop command-and-control mechanism, making takedown more difficult than with conventional centralized C2.
CanisterWorm propagated by abusing stolen package publishing tokens, particularly in the npm ecosystem, where it automatically infected packages controlled by compromised maintainers and expanded across dozens of packages and more than a hundred malicious artifacts. It was also observed propagating across Kubernetes-connected environments and developer systems. On Linux systems outside CI/CD contexts, it established persistence by masquerading as legitimate services and utilities, including systemd user services and a PostgreSQL-themed component, enabling periodic retrieval of follow-on payload locations.
Its core functionality included harvesting cloud access tokens, credentials, API keys, and other authentication material associated with AWS, Google Cloud Platform, and Microsoft Azure, as well as broader secrets available on developer machines and CI/CD environments. Reported behavior also included searching for package publishing credentials, Kubernetes access material, SSH-related data, and other secrets that could support further propagation and downstream compromise. The malware therefore functioned both as a worm and as a credential-harvesting platform for continued intrusion activity.
CanisterWorm also incorporated destructive capability. Multiple reports describe a wiper component or wiper-capable variant that targeted Kubernetes environments through privileged DaemonSet deployment and, in some cases, recursive file deletion on affected hosts. This destructive behavior was conditionally triggered based on Iranian locale indicators such as timezone or Farsi language settings. On non-targeted systems, the malware instead favored persistence and continued propagation.
The malware formed part of a broader TeamPCP credential-cascade operation in which secrets stolen from one compromised CI/CD or developer environment were reused to compromise additional repositories, package registries, and downstream organizations. CanisterWorm is therefore best understood as a hybrid credential-stealing worm with persistence and selective wiper behavior, aimed primarily at cloud-native development, CI/CD, and Kubernetes-linked environments.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
5 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2026-33634 (CVSS4B 9.4, Critical) has been assigned to the Trivy ecosystem compromise and was added to CISA's Known Exploited Vulnerabilities Catalog on March 26, 2026.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182.
Aikido Security - TeamPCP deploys CanisterWorm on NPM ... CanisterWorm — Self-propagating worm using ICP Canister for C2 ... File System Indicators /tmp/pglog (CanisterWorm payload drop path)
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
In a matter of weeks, TeamPCP deployed: a multi-stage credential stealer targeting CI/CD pipelines and developer machines; CanisterWorm, a Kubernetes-targeting wiper using privileged DaemonSets for destructive cluster-wide attacks; and a C++ RAT...
33 distinct techniques documented for this family, organized by ATT&CK tactic.
attackers used the residual service account token to force-push 76 of 77 version tags in the aquasecurity/trivy-action repository and all 7 tags in aquasecurity/setup-trivy to malicious commits.
the malware ... autonomously publishes the malware to every package the victim has publish rights to—transforming each victim into a propagation vector without further attacker intervention
What it is: Multi-stage supply chain compromise of Aqua Security’s Trivy scanner, trivy-action GitHub Action, setup-trivy GitHub Action, and Aqua’s internal GitHub organisation.
After a 5-minute sleep, it polls an ICP canister... every ~50 minutes.
Each successive wave also showed technical evolution: monolithic bash scripts became modular loaders...
As of March 22, the canister was actively serving kamikaze.sh, an iteratively developed payload.
After a 5-minute sleep, it polls an ICP canister... every ~50 minutes.
attackers used the residual service account token to force-push 76 of 77 version tags in the aquasecurity/trivy-action repository and all 7 tags in aquasecurity/setup-trivy to malicious commits.
After a 5-minute sleep, it polls an ICP canister... every ~50 minutes.
On GitHub-hosted Linux runners, the malware uses passwordless sudo to dump Runner.Worker process memory via /proc/[pid]/mem, parsing readable memory regions and searching for {"value":"<secret>","isSecret":true}.
attackers used the residual service account token to force-push 76 of 77 version tags in the aquasecurity/trivy-action repository and all 7 tags in aquasecurity/setup-trivy to malicious commits.
exfiltrating via typosquatted domains including scan.aquasecurtiy[.]org and checkmarx[.]zone
On GitHub-hosted Linux runners, the malware uses passwordless sudo to dump Runner.Worker process memory via /proc/[pid]/mem, parsing readable memory regions and searching for {"value":"<secret>","isSecret":true}.
A kill-switch is embedded in the payload: if the returned URL contains youtube.com, execution is skipped, allowing the attacker to keep infected systems dormant and avoid detection.
CanisterWorm was observed using the ICP canister C2 infrastructure to propagate across Kubernetes environments ... and executing recursive file deletion in affected clusters.
Tokens stolen in the Trivy compromise were used to compromise LiteLLM’s PyPI publishing pipeline five days later.
...a 1-in-6 chance of running a recursive wipe on systems matching Israeli or Iranian locales... The original TeamPCP campaign report documented a conditional wiper... checked whether the infected system's timezone was set to Iran or its default language was Farsi...
Lateral movement is expected: attackers have been observed creating new workflows in new branches specifically to exfiltrate secrets from additional repositories after gaining initial access.
archived as tpcp.tar.gz, and exfiltrated to attacker infrastructure at scan.aquasecurtiy[.]org
Primary: HTTPS POST to scan.aquasecurtiy[.]org (45.148.10.212) with header X-Filename: tpcp.tar.gz. Fallback: If the C2 returns non-2xx and INPUT_GITHUB_PAT is available, the malware creates a public repository called tpcp-docs on the victim’s own GitHub account and uploads the bundle as a release asset.
CanisterWorm, a Kubernetes-targeting wiper using privileged DaemonSets for destructive cluster-wide attacks
98 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
105 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A self-propagating npm worm that harvested npm tokens from compromised environments, authenticated to npm, enumerated publishable packages, bumped package versions, and republished malicious packages. Its payload chain installed a persistent Python backdoor via systemd and polled an ICP canister for updated payloads.
Self-propagating malware used in TeamPCP supply chain attacks to steal cloud credentials, API keys, SSH keys, and Kubernetes secrets.
Credential-stealing malware used to harvest cloud access tokens, credentials, and API keys from AWS, GCP, and Azure environments.
Credential-stealing malware used to harvest cloud access tokens, credentials, and API keys from AWS, GCP, and Azure environments.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.