The Worm in the Machine: Dissecting the Self-Spreading npm Attack
A new npm worm doesn't just steal your keys-it turns your own code into a weapon. A deep dive into the CanisterWorm's anatomy, from postinstall hooks to its unkillable blockchain C2.
Tag: #malware
A new npm worm doesn't just steal your keys-it turns your own code into a weapon. A deep dive into the CanisterWorm's anatomy, from postinstall hooks to its unkillable blockchain C2.
In March 2026, the TeamPCP threat actor compromised PyPI packages LiteLLM 1.82.7 and 1.82.8, injecting infostealer malware that turned developer workstations into credential harvesting engines.