A highly automated npm supply chain campaign, dubbed “CanisterWorm,” in which threat actors steal npm access tokens and weaponize legitimate publisher accounts at scale.
The group, tracked as “TeamPCP,” has compromised trusted namespaces including @emilgroup and @teale.io, pushing new SDK versions that silently deploy a persistent backdoor and then self-spread across every package the victim maintains.
Unlike classic typosquatting, CanisterWorm starts from real, already‑trusted packages. Once attackers obtain a valid npm publishing token or equivalent CI/CD access, they replace legitimate package contents with a malicious build that looks benign in version history but contains an extra postinstall hook.
This hook runs automatically during npm install, so developers are infected simply by resolving dependencies, with no additional execution step.
The postinstall logic drops and launches a Python backdoor, then sets up persistence on Linux via a user-level systemd service named pgmon, installed under ~/.config/systemd/user/pgmon.service.
That service is configured to restart automatically and run from a hidden directory under ~/.local/share/pgmon/, giving attackers long‑term access even after the original node_modules directory is deleted.
Decentralized ICP C2 and token theft
For command and control, the backdoor repeatedly polls an Internet Computer Protocol (ICP) canister endpoint, specifically tdtqy-oyaaa-aaaae-af2dq-cai.raw.icp0.io, which acts as a dead‑drop channel.
JFrog’s threat intelligence team reports that the blast radius now spans a wide set of SDKs and tooling across multiple organizations.
The canister does not serve malware directly, but instead returns a plain‑text URL for a second‑stage binary, allowing operators to rotate payloads or temporarily disarm the campaign without touching the infected hosts.
Retrieved payloads are stored in /tmp/pglog, while execution state is tracked in /tmp/.pg_state to manage polling and execution flow.
In parallel, the JavaScript loader aggressively harvests npm credentials from multiple locations. It parses local .npmrc files in projects, the user’s ~/.npmrc, and /etc/npmrc for _authToken entries, and also inspects environment variables such as NPM_TOKEN and NPM_TOKENS.
The malware further executes npm config get //registry.npmjs.org/:_authToken to capture any token configured via npm’s own settings, maximizing its chance of extracting publish‑level secrets.
Once tokens are collected, CanisterWorm turns into a self‑propagating supply chain worm. A deploy.js script uses the stolen credentials to query the npm registry search API (/-/v1/search) and enumerate all packages that the compromised user can publish.
For each package, it automatically bumps the patch version, injects the malicious postinstall payload, and repushes to npm with npm publish –access public –tag latest, effectively backdooring the publisher’s entire portfolio in seconds.
Newly identified compromised versions include @emilgroup/discount-sdk 1.5.1, @emilgroup/document-uploader 0.0.10, @emilgroup/docxtemplater-util 1.1.2, @emilgroup/numbergenerator-sdk-node 1.3.1, @emilgroup/partner-portal-sdk 1.1.1, @emilgroup/setting-sdk 0.2.1, @emilgroup/task-sdk 1.0.2, and @emilgroup/task-sdk-node 1.0.2, which were not covered in initial public disclosures.
Mitigations
Organizations using any of the listed versions are advised to assume compromise and move quickly to contain the worm’s ability to spread.
First, all npm publishing tokens and CI/CD secrets on potentially affected hosts should be rotated, with new credentials constrained to the minimum required scope and limited lifetimes.
Teams should audit npm logs and package histories to detect unauthorized publishes from their namespaces and unpublish any malicious patch versions so downstream consumers cannot accidentally install them.
On Linux, defenders must remove the persistence layer by stopping and turning off the pgmon systemd user service, then deleting the associated unit file and data directories, including ~/.config/systemd/user/pgmon.service, ~/.local/share/pgmon/, /tmp/pglog, and /tmp/.pg_state.
Projects should then purge and reinstall dependencies by removing node_modules, cleaning the npm cache, and explicitly pinning affected SDKs to known‑good versions predating the attack window.
To reduce exposure to similar attacks in the future, security teams can consider globally disabling lifecycle scripts with npm config set ignore-scripts true and selectively re‑enabling them using tooling such as @lavamoat/allow-scripts.
Hardening system policies to block unapproved writes to user systemd directories, and introducing curated dependency workflows like JFrog Curation, adds further friction for attackers attempting to turn individual tokens into ecosystem‑wide supply chain breaches.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
