npm Worm Turns Developer Tokens Into Propagation Fuel
A developer machine is now the blast radius. CanisterSprawl does not need to break production first. It steals npm tokens, secrets, and cloud credentials during package install, then uses those tokens to publish poisoned package versions back into the registry, so one compromised workstation can seed the next wave of installs.
Socket and StepSecurity tracked the campaign across six packages: @automagik/genie 4.260421.33-4.260421.40, @fairwords/loopback-connector-es 1.4.3-1.4.4, @fairwords/websocket 1.0.38-1.0.39, @openwebconcept/design-tokens 1.0.1-1.0.3, @openwebconcept/theme-owc 1.0.1-1.0.3, and pgserve 1.1.11-1.1.14. The worm uses a postinstall hook and an ICP canister for exfiltration, and it also carries PyPI propagation logic, which makes the campaign broader than a single npm incident.
The immediate risk is token reuse. If CI or developer machines still hold npm credentials, the attacker can keep publishing poisoned packages even after the first infected host is cleaned up. That turns package maintenance into a supply-chain propagation channel that can outlive the original compromise.