CanisterWorm — self-propagating npm worm hits Namastex Labs' Automagik AI-agent packages, uses an Internet Computer canister as a dead drop

View raw markdownEdit on GitHub ↗

TL;DR

A self-propagating npm worm — dubbed CanisterWorm for its use of an Internet Computer Protocol (ICP) canister as exfiltration infrastructure — compromised packages belonging to Namastex Labs (an agentic-AI vendor whose @automagik/genie package is part of its "Automagik" autonomous-agent suite), plus several unrelated packages sharing the same embedded RSA key material. The payload steals a broad set of developer/cloud credentials and crypto-wallet data at install time, then self-propagates by hijacking the maintainer's own npm publish tokens to inject itself into further packages. Code references tie it to the TeamPCP threat actor, the same group behind the Trivy/LiteLLM GitHub Actions compromise and other 2026 campaigns already tracked in this repo.

What happened

Socket.dev and other researchers identified a wave of trojanized npm releases starting 2026-04-22, publicly reported as still developing (additional malicious versions were being published as the story broke). Confirmed compromised packages/versions:

  • @automagik/genie 4.260421.33–4.260421.39 — part of Namastex Labs' Automagik autonomous-AI-agent product suite
  • pgserve 1.1.11–1.1.13 — also tied to Namastex; researchers noted these versions lack corresponding Git tags despite the repository's history tracking tags through v1.1.10, suggesting a release-path compromise (the attacker published directly to npm without a matching, reviewable Git commit) rather than a stolen account posting from the legitimate source.
  • @fairwords/websocket 1.0.38–1.0.39
  • @fairwords/loopback-connector-es 1.4.3–1.4.4
  • @openwebconcept/design-tokens and @openwebconcept/theme-owc 1.0.3

All carry the same embedded RSA key material used by the malicious payload, indicating one campaign across unrelated maintainer accounts.

Payload mechanics: a postinstall script triggers at install time (blockable via --ignore-scripts or npm v12's allowScripts: off default, unlike binding.gyp-triggered payloads tracked elsewhere in this repo). It harvests a broad credential set — environment variables matching common secret-naming patterns, .npmrc, SSH keys, .git-credentials, .netrc, AWS/Azure/GCP cloud credentials, Kubernetes/Docker/Terraform configuration, browser-stored logins, and crypto-wallet data (MetaMask, Phantom, Solana, Ethereum). Stolen data is encrypted with an AES-256-CBC + RSA-OAEP-SHA256 hybrid scheme and exfiltrated to two channels: a webhook at telemetry.api-monitor[.]com/v1/telemetry (styled to look like ordinary telemetry) and an ICP (Internet Computer Protocol) canister at cjn37-uyaaa-aaaac-qgnva-cai.raw.icp0[.]io/drop — a blockchain-hosted, decentralized-compute dead drop, extending this repo's already-tracked list of blockchain C2 channels (Solana memos, Ethereum smart contracts, Tron/Aptos/BNB Smart Chain transaction queries) to a new platform.

Self-propagation: the worm extracts any npm publish tokens it finds on the infected host, enumerates which packages those tokens can publish to, injects the same malicious postinstall hook, and republishes — the same worm shape as this repo's tracked Shai-Hulud lineage, but running over freshly-stolen tokens rather than a single compromised maintainer account. A PyPI propagation path via .pth file injection was also observed, extending the worm cross-ecosystem.

TeamPCP attribution: the malicious Python injection logic contains an explicit code-level reference to a "TeamPCP/LiteLLM method" — the same threat actor and technique lineage this repo already tracks in the Trivy/LiteLLM GitHub Actions compromise. Researchers also note the ICP-canister infrastructure pattern matches a prior, smaller CanisterWorm wave that compromised 29 packages using the same canister-backed C2 — this repo had not previously tracked either wave.

Am I affected?

# Check your lockfile for any of the compromised package/version combinations
grep -E "@automagik/genie|pgserve|@fairwords/websocket|@fairwords/loopback-connector-es|@openwebconcept/design-tokens|@openwebconcept/theme-owc" package-lock.json pnpm-lock.yaml yarn.lock 2>/dev/null

# Look for the exfiltration endpoints in node_modules (if you suspect a run occurred)
grep -r "api-monitor\|icp0.io/drop\|cjn37-uyaaa" node_modules/ 2>/dev/null

If any match, treat every credential the malware targets (npm tokens, SSH keys, cloud creds, browser-stored logins, crypto wallets) as compromised — this campaign was still expanding as of disclosure, so also check for versions published after 2026-04-22 that may not be listed above.

If you are affected

  1. Remove the affected package versions and pin to a known-clean version or a patched release.
  2. Rotate: npm publish tokens, SSH keys, cloud credentials (AWS/Azure/GCP), .netrc/.git-credentials contents, and any crypto wallet whose extension data lives on the affected machine.
  3. → playbooks/if-you-ran-malicious-postinstall.md
  4. → playbooks/if-your-npm-token-leaked.md
  5. → playbooks/rotating-cloud-credentials.md

Prevention

→ prevention/npm-hardening.md — --ignore-scripts / npm v12 allowScripts: off blocks this specific payload's install-time trigger (a postinstall hook, not a binding.gyp build step). → prevention/supply-chain-attack-surface.md → prevention/credential-hygiene.md

Sources