Self-Propagating npm Malware Turns Trusted Packages Into Attack Paths

Sonatype details CanisterSprawl, a self-propagating npm malware campaign that steals sensitive developer data (tokens, API keys) and seeks to abuse compromised publisher accounts to publish additional malicious packages, creating an elevated software supply-chain threat. Organizations are urged to remove infected packages, rotate exposed secrets, and monitor for unauthorized publishing.