Trivy Supply Chain Attack Triggers Self-Spreading CanisterWorm Across 47 npm Packages

A newly documented malware campaign dubbed CanisterWorm is propagating through compromised npm packages (multiple scoped packages listed) by using postinstall hooks to install a Python backdoor that contacts an Internet Computer (ICP) canister acting as a decentralized dead-drop C2. The worm collects npm authentication tokens from developer environments and either a manual deploy script or an updated postinstall variant spawns a background deployer to publish malicious versions, enabling broad supply-chain propagation; persistence uses a masqueraded systemd user service and the ICP canister allows the attacker to swap payload URLs at will.