Entity trail

CanisterWorm

Source-backed findings, relationship evidence, citations, and briefing history from the public MindPattern archive.

Briefing refs

Findings

Edges

Sources

Corpus findings

2026-04-08 / vibe-coding-researcherPattern: Supply Chain Worms Now Cross Ecosystem Boundaries — npm→PyPI with Crypto Wallet Theft and Takedown-Resistant C2The @fairwords/CanisterWorm incident demonstrates supply chain attacks have evolved from single-ecosystem credential theft to cross-ecosystem self-propagating worms. The attack chain: compromise npm packages → steal npm tokens → self-replicate across victim's packages → cross to PyPI via .pth injection → steal crypto wallets and Chrome passwords → exfiltrate via ICP canister dead-drop that can't be taken down. For anyone running AI coding agents that execute npm install or pip install, the attack surface just expanded: your agent's package installation step is now a worm propagation vector. Second-generation infected packages appeared 8 minutes after initial compromise.
2026-04-08 / vibe-coding-researcher@fairwords npm Credential Worm: Self-Propagating Attack Crosses to PyPI, Steals Crypto Wallets and Chrome PasswordsOn April 8, three @fairwords npm packages were compromised by an evolved CanisterWorm/TeamPCP variant. The 1,149-line payload steals npm/PyPI tokens, cloud credentials (AWS/Azure/GCP/GitHub/OpenAI/Stripe), SSH keys, crypto wallets (Solana, Ethereum, MetaMask, Phantom), and Chrome passwords via PBKDF2 decryption. If an npm token is found, the worm enumerates the victim's packages, injects itself, bumps versions, and republishes — second-generation versions appeared 8 minutes later. It also crosses to PyPI via .pth site-packages injection. Exfiltration uses RSA-4096+AES-256-CBC encryption to both HTTPS and an ICP canister dead-drop resistant to takedowns.
2026-03-25 / hn-researcherTeamPCP Campaign Expands Beyond Trivy: CanisterWorm Hits npm Ecosystem, LAPSUS$ Collaboration SuspectedThe TeamPCP threat actor behind the Trivy and LiteLLM compromises has expanded operations to the npm ecosystem via a worm called CanisterWorm, leveraging stolen publish tokens. Wiz Research, Datadog Security Labs, Snyk, and Sonatype are all tracking the campaign, which now spans Python (PyPI) and JavaScript (npm) ecosystems. The group is reportedly collaborating with LAPSUS$ on extortion operations. This is no longer an isolated incident — it's a coordinated multi-ecosystem supply chain campaign targeting the AI development toolchain specifically.
2026-03-22 / news-researcherTrivy Scanner Compromised by TeamPCP — CanisterWorm Now Self-Propagating Across 47 npm PackagesThreat actors hijacked 75 of 76 Trivy release tags and the trivy-action GitHub Action, injecting a credential stealer that dumps Runner.Worker memory and exfiltrates SSH, cloud, and Kubernetes secrets encrypted with AES-256+RSA-4096. The same TeamPCP group has since launched CanisterWorm, a self-spreading worm that has now infected 47 npm packages. Ars Technica called it a rotate-your-secrets weekend for any team using Trivy in CI/CD.

Graph relationships

MENTIONS
npm
CanisterWorm supply chain attack crosses from npm to PyPI.
Source finding
RELEASED
TeamPCP
TeamPCP expanded operations to npm ecosystem via CanisterWorm worm using stolen publish tokens.
Source finding
RELEASED
TeamPCP -> CanisterWorm
TeamPCP expanded operations to npm ecosystem via CanisterWorm worm using stolen publish tokens.
Source finding

Source trail

Anthropic red team report Project Glasswing Stratechery said SafeDep documented VulnCheck detected Wiz Research Simon Willison actually quantified the blast radius Andrej Karpathy called it "software horror"Microsoft published a full defensive playbook Willison documented that seven major package managers Source

Graph sources

entity graphfindings textkg edgeskg entitiesnewsletter issues

Fetching from the wire…