Ethical Hacking News
Threat actors have been exploiting a vulnerability in npm packages to spread a self-propagating worm called CanisterWorm. This worm uses an ICP canister as a dead drop resolver and has already infected multiple systems, highlighting the need for robust security measures to prevent such attacks.
The Internet Computer (IC) has been exploited by a group of threat actors using malicious CanisterWorms that leverage npm packages for propagation. The CanisterWorm uses an ICP canister as a dead drop resolver, allowing it to fetch the command-and-control (C2) server. The worm was detected in compromised npm packages from various scopes, including @EmilGroup, @opengov, and @teale.io/eslint-config. The CanisterWorm uses a postinstall hook to execute a loader, which then drops a Python backdoor that contacts the ICP canister dead drop. The infection chain is resilient due to decentralized dead drop infrastructure, making it hard to take down. The worm's self-propagation capability without manual intervention highlights the need for robust security measures. The detection of CanisterWorm emphasizes the importance of monitoring supply chain vulnerabilities and identifying potential threats.
The Internet Computer (IC) is a decentralized blockchain platform that enables developers to create and deploy smart contracts on its network. However, in recent times, the platform has been exploited by a group of threat actors who have leveraged the ICP canister's functionality for malicious purposes. One such example is the CanisterWorm, a self-propagating worm that exploits npm packages to infect systems.
The CanisterWorm uses an ICP canister as a dead drop resolver, allowing it to fetch the command-and-control (C2) server. This worm was first detected in a list of compromised npm packages, which included 28 packages from the @EmilGroup scope, 16 packages from the @opengov scope, and two packages from the @teale.io/eslint-config scope.
According to Aikido Security researcher Charlie Eriksen, "The development marks the first publicly documented abuse of an ICP canister for the explicit purpose of fetching the command-and-control (C2) server." The CanisterWorm uses a postinstall hook to execute a loader, which then drops a Python backdoor that contacts the ICP canister dead drop to retrieve a URL pointing to the next-stage payload.
The infection chain involving the npm packages involves leveraging a postinstall hook to execute a loader, which then drops a Python backdoor that's responsible for contacting the ICP canister dead drop to retrieve a URL pointing to the next-stage payload. The fact that the dead drop infrastructure is decentralized makes it resilient and resistant to takedown efforts.
The worm also includes a "deploy.js" file that the attacker runs manually to spread the malicious payload to every package a stolen npm token provides access to in a programmatic fashion. This worm was detected in "@teale.io/eslint-config" versions 1.8.11 and 1.8.12, which are self-propagating without the need for manual intervention.
The CanisterWorm is particularly concerning because it demonstrates how easily an attacker can exploit a supply chain vulnerability to spread malware across multiple systems. The use of npm packages as vectors for propagation highlights the need for robust security measures to protect these packages from malicious actors.
Furthermore, the worm's ability to self-propagate without manual intervention underscores the importance of implementing robust security controls to prevent such attacks. In this case, the use of a postinstall hook and a Python backdoor allowed the CanisterWorm to infect systems without being detected by traditional security measures.
The detection of CanisterWorm highlights the need for threat actors and security researchers to stay vigilant in monitoring supply chain vulnerabilities and identifying potential threats before they can be exploited. The Internet Computer's decentralized nature makes it an attractive target for malicious actors, but with proper security measures in place, it is possible to prevent such attacks from being successful.
The fact that the attacker swapped out the ICP backdoor payload for a dummy test string ("hello123") likely indicates that the entire attack chain was working as intended before adding the malware. This suggests that the attackers are taking steps to ensure the success of their operation and are willing to adapt their tactics to achieve their goals.
In conclusion, the CanisterWorm represents a significant threat to systems compromised by npm packages infected with this worm. The use of an ICP canister as a dead drop resolver highlights the need for robust security measures to prevent such attacks. As the threat landscape continues to evolve, it is essential for developers and security professionals to remain vigilant in monitoring supply chain vulnerabilities and identifying potential threats before they can be exploited.
Related Information:
https://www.ethicalhackingnews.com/articles/The-Internet-Computers-CanisterWorm-A-Self-Propagating-Worm-that-Exploits-npm-Packages-ehn.shtml
https://thehackernews.com/2026/03/trivy-supply-chain-attack-triggers-self.html
https://www.zestsecurity.io/resources/content/trivy-supply-chain-attack-github-actions
Published: Sat Mar 21 03:03:53 2026 by llama3.2 3B Q4_K_M
