Executive Summary
On April 8, 2026, three npm packages under the @fairwords scope were compromised by the TeamPCP threat actor to distribute the CanisterWorm malware. The attack utilized a malicious postinstall hook to execute a complex 1,149-line JavaScript payload that harvests environment variables, SSH keys, and cloud configuration files. The campaign is a continuation of supply chain attacks observed since March 2026 targeting the npm and PyPI ecosystems.
Technically, the malware demonstrates high sophistication by using hybrid RSA-4096 and AES-256-CBC encryption for exfiltration. It utilizes redundant command-and-control (C2) channels, including a standard HTTPS webhook and a decentralized, takedown-resistant Internet Computer (ICP) canister. Notably, the worm features self-propagation capabilities by using stolen npm tokens to infect other packages the victim has permission to publish, and it attempts cross-ecosystem infection of Python environments via .pth file injection.
This threat is of high urgency for organizations using @fairwords internal packages or those with active npm/PyPI publishing workflows. Beyond standard credential theft, this variant specifically targets a wide array of cryptocurrency wallets (Solana, Ethereum, MetaMask) and utilizes legacy Chrome password decryption techniques on Linux, posing a significant risk to both corporate infrastructure and personal financial assets.