Excerpt
Mar 21, 2026
On 20 Mar 2026, 20:45 UTC, we detected a large number of packages being compromised on NPM with a new worm that hasn't been observed before. We're calling this specific attack CanisterWorm, because it makes use of an ICP Canister for its C2 dead-drop, which is the first time we've seen in a campaign like this. They've compromised so far:
28 packages in the @EmilGroup scope
16 packages in the @opengov scope
The package @teale.io/eslint-config
The package @airtm/uuid-base32
The package @pypestream/floating…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by Aikido on aikido.dev.
Mentioned in the excerpt
More from Aikido2
- CanisterWorm Gets Teeth: TeamPCP's Kubernetes Wiper Targets IranAikido · Published 22 Mar
- Popular telnyx package compromised on PyPI by TeamPCPAikido · Published 27 Mar
On the same topics
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Trust the Tunnel, Get the Trojan: Silver Fox Delivers Atlas RAT via Weaponized VPN Installershexastrike.com · Published 25 Mar
- Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent TrafficThe Hacker News · Published 19 Oct
- Investigating Ephemeral Supply Chain TamperingMandiant (Google) · Published 15 Oct
