TeamPCP deploys CanisterWorm on NPM following Trivy compromise

On 2026-03-20 a self-propagating supply-chain campaign named "CanisterWorm" compromised dozens of npm packages by publishing malicious postinstall code that writes a Python backdoor (pgmon) as a user-level systemd service, uses an Internet Computer (ICP) canister as a decentralized C2 dead-drop to rotate payloads, and evolved to harvest npm authentication tokens to automatically spread across developer accounts and CI systems; the report includes technical breakdowns, sample code, IOC hashes, file paths, and C2 URLs.