Log in Request a demo

Malware profile

CanisterWorm

CanisterWorm is a self-propagating worm that steals cloud and developer credentials and uses stolen npm tokens to push itself into more software packages.

In short

CanisterWorm is a self-propagating worm that steals cloud and developer credentials and uses stolen npm tokens to push itself into more software packages. MITRE says it has a wiper part aimed at Kubernetes and Iranian systems, and that it can fetch payload locations from a blockchain canister. The FBI lists it among the malware deployed by the cyber criminal group TeamPCP.

Last updated 9 October 2026

Profile MapMalware
  1. Names1names in public reportsCanisterWorm
  2. Techniques17ATT&CK techniques listedInitial Access · Execution · Persistence
  3. Linked Groups1groups that use itTeamPCP

In one minute

What it is
A self-propagating worm that harvests credentials and spreads through npm packages.
What it does
Steals cloud tokens and SSH keys, uses stolen npm tokens to publish itself into more packages, and has a wiper part that MITRE says is limited to Kubernetes systems in Iran.
Who uses it
Attributed by the FBI (2 July 2026) to the cyber criminal group TeamPCP. The BSI (26 March 2026) says TeamPCP is said to be behind the campaign in which CanisterWorm appeared. MITRE also lists TeamPCP.
How it gets in
Trusted npm packages. MITRE says it used stolen npm and Trivy-user tokens to publish infected versions.
What to do first
Pin GitHub Actions to full commit hashes and rotate CI/CD, cloud and npm publishing secrets that were reachable during the exposure windows.

What it does

MITRE describes CanisterWorm as a worm that uses stolen npm credentials to infect software packages and spread across developer ecosystems. It also has a targeted wiper component, and it can use a blockchain canister on the Internet Computer Protocol as a hidden command channel.

The BSI names CanisterWorm (npm) as one of the software ecosystems hit by the campaign around the Trivy attack, which it says the group TeamPCP is said to be behind.

Names

Public sources use several names for this malware.

Names
NameWhere it appears
CanisterWormMITRE ATT&CK software S9042, the FBI FLASH, the BSI warning and the CERT-EU March 2026 cyber brief[1, 2, 3, 4]

What it can do

What MITRE ATT&CK lists this malware as doing, by tactic. Each id opens our technique page where one exists, otherwise MITRE.

Initial Access

  • Supply Chain Compromise: Compromise Software Dependencies and Development Tools T1195.001

    It spreads through an automated process that infects and publishes npm packages.[1]

Execution

  • Poisoned Pipeline Execution T1677

    It used tokens stolen from users of the Trivy scanner to publish itself across more than 46 npm packages.[1]

  • Command and Scripting Interpreter: JavaScript T1059.007

    It uses stolen tokens to run a JavaScript file (deploy.js) that carries out the self-propagation.[1]

  • Container Administration Command T1609

    It can deploy privileged DaemonSets in Kubernetes clusters and use kubectl to wipe data.[1]

Persistence

  • Create or Modify System Process T1543

    In CI/CD environments it stays in place by starting a background process with stolen tokens.[1]

Stealth

  • Execution Guardrails T1480

    It limits when it acts, for example by stopping its wiper if Kubernetes is not found or the target is not in Iran.[1]

  • Virtualization/Sandbox Evasion: Time Based Checks T1497.003

    It waits five minutes before running its tasks, to avoid sandbox analysis.[1]

Credential Access

  • Steal Application Access Token T1528

    It gathers cloud access tokens, which the FBI also lists as its target.[1, 2]

  • Credentials from Password Stores: Cloud Secrets Management Stores T1555.006

    It gathers credentials from AWS, Google Cloud and Microsoft Azure.[1, 2]

  • Unsecured Credentials: Private Keys T1552.004

    It collects SSH private keys from the .ssh folder.[1]

Discovery

  • Container and Resource Discovery T1613

    It fingerprints its environment to find Kubernetes clusters and pods.[1]

  • System Location Discovery: System Language Discovery T1614.001

    It checks the time zone and language settings for an Iranian locale before it deploys the wiper.[1]

Lateral Movement

  • Use Alternate Authentication Material: Application Access Token T1550.001

    It uses stolen npm tokens to list publishable packages in a namespace, raise versions and publish itself across the scope.[1]

Command and Control

  • Web Service: Dead Drop Resolver T1102.001

    It polls a decentralized Internet Computer Protocol canister to get a changing URL for its payload.[1]

  • Ingress Tool Transfer T1105

    It downloads and runs binaries from URLs obtained from the canister, and can download kubectl if it is missing.[1]

Impact

  • Data Destruction T1485

    Its wiper part can delete whole Kubernetes clusters and run recursive file deletion on hosts without containers.[1]

  • System Shutdown/Reboot T1529

    It forces the system to reboot after files are deleted.[1]

How it spreads

MITRE says CanisterWorm spreads through an automated process that infects and publishes npm packages. It uses stolen npm tokens to list every package the token owner can publish in a namespace, raise the version number and publish itself across the whole scope. MITRE also says it used tokens stolen from Trivy users to publish itself across more than 46 npm packages.

Timeline

  1. 19 March 2026

    Trivy supply chain attack begins

    The BSI says the Trivy scanner has been affected by a supply chain attack since 19 March 2026.[3]

  2. 20 March 2026

    Trivy compromise reported

    CERT-EU says a researcher reported on 20 March that TeamPCP compromised Trivy, and that the same actor was linked to a follow-up campaign deploying an npm worm named CanisterWorm.[4]

  3. 26 March 2026

    BSI warning

    The BSI warning BITS-V 2026-237970-1032 lists npm (CanisterWorm) among the ecosystems the campaign reaches, and says more libraries and projects are expected to be targeted.[3]

  4. 1 April 2026

    CERT-EU March cyber brief

    CERT-EU releases Cyber Brief 26-04, which describes the Trivy compromise and links CanisterWorm to the same actor.[4]

  5. 2 July 2026

    FBI FLASH on TeamPCP

    The FBI releases FLASH-20260702-01 and lists CanisterWorm among the malware deployed by TeamPCP, with indicators and recommendations.[2]

Detection and defense

  1. Pin GitHub Actions to commit hashes

    The FBI and the BSI both advise referencing GitHub Actions by full commit hash, not by tags or branches that can be changed.[2, 3]

    Counters: T1195.001 T1677

  2. Rotate secrets that were reachable

    The FBI advises rotating CI/CD secrets, publishing tokens and cloud credentials accessible during the exposure windows. The BSI lists cloud, Git, container, SSH, Kubernetes and npm publishing credentials.[2, 3]

    Counters: T1528 T1555.006 T1552.004 T1550.001

  3. Limit publishing tokens

    The FBI advises least-privilege permissions on CI/CD service accounts and registry publishing tokens, with token scoping to stop spread between repositories, and phishing-resistant multifactor authentication for publishing accounts.[2]

    Counters: T1550.001 T1528

  4. Delay new package versions

    The FBI advises a minimum package age, for example 7 days, in all installation environments, so malicious versions are found before they are installed.[2]

    Counters: T1195.001

  5. Watch outbound traffic from build runners

    The FBI advises runtime behavior monitoring of CI/CD pipelines to catch unexpected outbound connections from runner processes.[2]

    Counters: T1102.001 T1105

  6. Look for worm-made repositories

    Both the FBI and the BSI advise searching GitHub for repositories named tpcp-docs (the FBI also names docs-tpcp). The BSI says their presence may show that a stolen-secrets fallback was triggered.[2, 3]

    Counters: T1528 T1555.006

  7. Use the official indicators

    The FBI FLASH-20260702-01 carries IP addresses, domains and file hashes for TeamPCP malware. The BSI advises searching firewalls, SIEM and GitHub audit logs for indicators and blocking any found.[2, 3]

    Counters: T1105 T1102.001

  8. Know your dependencies and isolate builds

    The BSI advises keeping a detailed inventory of components down to package level and running development environments in isolation, so a poisoned library does not reach production.[3]

    Counters: T1195.001

Questions

What is CanisterWorm?

MITRE describes it as a self-propagating malware used by TeamPCP in credential harvesting and software supply chain campaigns since at least 2026. It uses npm credentials to infect packages and has a targeted wiper component.

Who is behind CanisterWorm?

The FBI, in a FLASH of 2 July 2026, lists it as malware deployed by the cyber criminal group TeamPCP. CERT-EU linked the same actor to a follow-up campaign with an npm worm named CanisterWorm. The BSI says TeamPCP is said to be behind the campaign. MITRE also lists TeamPCP.

Why is it called CanisterWorm?

MITRE says it can use decentralized command infrastructure built on an Internet Computer Protocol blockchain canister. The sources reviewed here do not explain the choice of name.

Can CanisterWorm destroy data?

Yes in some cases. MITRE says the wiper part can delete whole Kubernetes clusters, and that it is held back if Kubernetes is not found or the target is not in Iran.

What should I do first?

The FBI and the BSI advise pinning GitHub Actions to commit hashes and rotating the CI/CD, cloud and publishing secrets that were reachable. Search GitHub for repositories named tpcp-docs.

In our research

  1. The Rise of Supply Chain Cyber Attacks: How Vendor Trust Becomes the Way In July 2026
  2. TeamPCP Threat group

Sources

  1. CanisterWorm, Software S9042 MITRE ATT&CKSupports: Description, platforms, techniques and the link to TeamPCP.
  2. Cyber Criminal Group TeamPCP (FLASH-20260702-01) FBISupports: CanisterWorm listed as TeamPCP malware, indicators and recommendations.
  3. Trivy: Supply-Chain Angriff führt zu Kompromittierungen in Deutschland (BITS-V 2026-237970-1032) BSISupports: Names npm (CanisterWorm) in the campaign, dates and recommendations.
  4. Cyber Brief 26-04 - March 2026 CERT-EUSupports: Trivy compromise on 20 March and the follow-up npm worm CanisterWorm.
  5. TeamPCP, Group G1056 MITRE ATT&CKSupports: Lists CanisterWorm among TeamPCP custom malware.

Browse the threat library

Keep exploring

Knowledge Hub

Glossary term

Infostealer

An infostealer is a type of malware that copies saved passwords, browser cookies and other data from an infected device and sends it to the attacker.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more

Technique

Command and Scripting Interpreter

Command and Scripting Interpreter is a technique where an attacker uses the built-in shells and scripting languages of a system to run commands, scripts or programs.

Read more