CanisterWorm: First Blockchain-Powered Self-Spreading Worm

First-Ever Blockchain C2 Worm Spreads Across npm Ecosystem

A previously undocumented self-propagating malware called CanisterWorm has compromised 47 npm packages, marking the first publicly documented abuse of Internet Computer Protocol (ICP) smart contracts as a command-and-control dead drop resolver. The worm emerged as a follow-on attack from the Trivy security scanner supply chain breach.

How CanisterWorm Propagates

The worm's self-spreading mechanism was first detected in @teale.io/eslint-config versions 1.8.11 and 1.8.12:

1. Postinstall Hook — When a developer installs a compromised package, the postinstall script triggers index.js
2. Token Harvesting — A findNpmTokens() function scans the victim's machine for npm authentication tokens (.npmrc files)
3. Package Infection — Using stolen tokens, the worm publishes backdoored versions of packages the developer has write access to
4. Downstream Spread — Anyone installing those newly infected packages repeats the cycle

The Blockchain C2 Innovation

What makes CanisterWorm novel is its use of ICP canisters — tamperproof smart contracts on the Internet Computer blockchain — as a dead drop resolver for its command-and-control server:

• The C2 address is stored in an immutable blockchain contract
• Traditional takedown requests to hosting providers are ineffective
• The canister acts as a redirect layer, pointing to the actual C2 infrastructure
• Operators can update the C2 address via the blockchain without modifying any malware code

Persistence Mechanism

Once installed on a development machine, CanisterWorm establishes persistence through a systemd service that survives reboots and continues to:

• Monitor for new npm tokens
• Exfiltrate environment variables and credentials
• Maintain a reverse shell to the C2 server

Recommendations

For Developers

• Audit your npm tokens — revoke and rotate all tokens immediately if you installed any suspicious packages
• Check .npmrc files for unexpected modifications
• Review postinstall scripts in dependencies before installing
• Use npm audit and lockfile-only installs in CI/CD

For Organizations

• Pin dependency versions and use lockfiles
• Implement allow-listing for npm package installations
• Monitor for unexpected npm publish events from developer accounts
• Scan for systemd services created by non-system processes

Key Takeaways

1. CanisterWorm is the first malware to use blockchain smart contracts as a C2 channel, creating infrastructure that cannot be taken down through traditional means
2. Self-propagation via stolen npm tokens means the worm spreads without human intervention
3. 47 packages confirmed compromised with potentially hundreds of thousands of downstream installations affected
4. TeamPCP is suspected as the threat actor, linking this to the broader Trivy supply chain compromise
5. The postinstall hook attack vector remains one of the most dangerous aspects of the npm ecosystem
6. Developers should immediately rotate npm tokens and audit their published packages for unauthorized versions

Sources

• Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm — The Hacker News
• TeamPCP deploys CanisterWorm on npm following Trivy compromise — Aikido Security
• CanisterWorm: The Self-Spreading npm Attack — Mend.io
• CanisterWorm supply chain malware attacks npm — iTnews