Trivy Got Owned and Spawned a Self-Replicating npm Worm — 47 Packages Deep
Trivy Got Owned and Spawned a Self-Replicating npm Worm — 47 Packages DeepA hardcoded secret, a blockchain dead drop, and a worm that vibe-coded itself into your CI/CD pipeline. Happy Friday.
47 npm packages compromised. 3 major scopes hit. First-ever ICP canister used as a C2 dead drop. The worm spreads itself — no human needed.
On March 19, somebody popped the Trivy vulnerability scanner — the same tool companies use to FIND vulnerabilities — and turned it into the vulnerability. The attackers rode stolen creds into GitHub Actions, poisoned every release tag, then dropped a self-propagating worm called CanisterWorm into npm. It steals your tokens and publishes itself to every package you have access to. Automatically. Look, the malware was literally vibe-coded with AI. We’re living in a meme.
🧩 Dumb Mode Dictionary
| Term | What It Actually Means |
|---|---|
| Trivy | Popular open-source vulnerability scanner. Irony: it got vulnerabled. |
| Supply Chain Attack | Poisoning the tools devs trust so the malware comes PRE-INSTALLED |
| ICP Canister | A smart contract on the Internet Computer blockchain — used here as a burner phone for malware |
| Dead Drop Resolver | Instead of a normal C2 server (that gets taken down), the malware checks a blockchain address for instructions |
| postinstall hook | Code that runs automatically when you npm install a package. The attacker’s front door. |
| systemd service | Linux background process. The worm disguised itself as “pgmon” (fake PostgreSQL tool) |
| CanisterWorm | The self-spreading payload. Finds your npm tokens and publishes infected versions of YOUR packages |
| TeamPCP | The crew behind it. Cloud-focused cybercriminals. |
📰 What Happened — The Timeline
- March 19: Attacker uses compromised credential to access Trivy’s GitHub repos
- Within hours: Force-pushed malicious tags to nearly ALL trivy-action and setup-trivy releases
- Same day: CanisterWorm starts appearing in npm packages across @EmilGroup, @opengov, and other scopes
- March 20: Aikido Security publishes initial analysis
- March 21: Trivy maintainer Itay Shakury confirms the breach, says all latest releases now point to safe versions
- March 22: The Hacker News reports 47 total packages compromised, worm is self-spreading
Real talk: the attacker had access for HOURS before anyone noticed. Every CI/CD pipeline that pulled Trivy during that window? Potentially cooked.
⚙️ How the Attack Chain Works
Look, this is actually clever. Here’s the play:
- Entry — Stolen credential gets attacker into Trivy’s build pipeline (hardcoded secrets, classic mistake)
- Poisoning — Force-push malicious code to GitHub Action tags. Anyone using
trivy-action@v1gets the bad version - Payload — postinstall hook drops a Python backdoor
- C2 via Blockchain — Backdoor pings an ICP canister (tamperproof smart contract) every 50 minutes with a spoofed browser User-Agent
- Canister responds with a URL pointing to the next-stage payload
- Persistence — systemd service called “pgmon” auto-restarts the backdoor if killed (
Restart=always, 5-second delay) - Worm mode —
findNpmTokens()harvests every npm auth token on the system, then publishes infected versions of every package those tokens can access
The canister supports three methods:
get_latest_link,http_request, andupdate_link— so attackers can swap payloads without touching the implant.
📊 The Damage — By the Numbers
| Metric | Count |
|---|---|
| Total compromised npm packages | 47 |
| @EmilGroup scope packages | 28 |
| @opengov scope packages | 16 |
| Other affected packages | 3 (@teale.io/eslint-config, @airtm/uuid-base32, @pypestream/floating-ui-dom) |
| Trivy GitHub Action tags poisoned | Nearly ALL |
| Time before detection | Several hours |
| C2 polling interval | Every 50 minutes |
| Current C2 response | A Rick Astley YouTube link (seriously) |
(That last one tells you the worm is still in testing phase. The rickroll is a placeholder. Next time it won’t be.)
🗣️ What the Researchers Are Saying
Charlie Eriksen, Aikido Security:
“Every developer or CI pipeline that installs this package and has an npm token accessible becomes an unwitting propagation vector. Their packages get infected, their downstream users install those, and if any of them have tokens, the cycle repeats.”
“This is the point where the attack goes from ‘compromised account publishes malware’ to ‘malware compromises more accounts and publishes itself.’”
On the AI angle:
The worm “is assessed to be vibe-coded using an AI tool” and “makes no attempt to conceal its functionality.”
Trivy maintainer Itay Shakury:
“We have removed all malicious artifacts from the affected registries and channels. If you suspect you were running a compromised version, treat it as a full compromise.”
Real talk: “treat it as a full compromise” means rotate everything. Tokens, keys, secrets. All of it.
🧠 Why This One Hits Different
Look, supply chain attacks aren’t new. But three things make CanisterWorm a new breed:
- Blockchain C2: Using an ICP canister as a dead drop means you can’t just take down a domain. The command infrastructure lives on a tamperproof blockchain. That’s a first.
- Self-propagation: Previous npm supply chain attacks (ua-parser-js, event-stream, colors.js) were one-and-done. This thing BREEDS. It finds your tokens and infects your packages automatically.
- AI-generated malware: The worm was vibe-coded. No sophistication needed. No obfuscation. Just “write me a worm” and ship it. The barrier to entry for supply chain attacks just dropped to zero.
(I’ve been watching npm supply chain attacks since the event-stream incident in 2018. This is the most aggressive propagation mechanism I’ve seen in the wild.)
Cool. Your Security Scanner Got Hacked and Now Your Packages Are Infecting Other People’s Packages. Now What the Hell Do We Do? ( ͡ಠ ʖ̯ ͡ಠ)
🔍 Hustle 1: Build an npm Token Audit Dashboard
Real talk: most dev teams have NO IDEA how many npm tokens are floating around their CI/CD pipelines. That’s the exact attack surface CanisterWorm exploits.
Build a simple dashboard (Node.js + a cron job) that scans your org’s CI runners and dev environments for exposed npm tokens, checks their scopes and permissions, and flags any with publish access. Sell it as a SaaS to agencies and dev shops. $29/month per org.
Example: A security consultant in São Paulo built a similar “token hygiene” tool for GitHub tokens after the Codecov breach. Charged R$150/month (~$30). Got 40 clients in 6 weeks through LinkedIn cold outreach to CTOs. $1,200/month recurring.
Timeline: MVP in a weekend. First paying customers within 2 weeks if you hit DevSecOps Slack communities hard.
🛡️ Hustle 2: Offer 'Supply Chain Hardening' as a Freelance Service
Every mid-size company just read this headline and panicked. They’re running Trivy in their pipelines RIGHT NOW and they don’t know if they were hit. That’s your opening.
Package up a service: audit their CI/CD for hardcoded secrets, pin all GitHub Action versions to commit SHAs instead of tags, set up npm package provenance verification, and write them a runbook. Charge $2,000-$5,000 per engagement.
Example: A freelance DevOps engineer in Kraków pivoted to “supply chain audits” after the SolarWinds attack. Posted one detailed thread on Twitter about what to check. Got 3 inbound leads in a week. Closed $8,500 in the first month.
💰 Hustle 3: Create a 'Lockdown Mode for npm' CLI Tool
The play: a single CLI command that hardens your local npm setup. It removes all stored tokens, switches to short-lived tokens only, adds a pre-publish hook that checks for known malicious patterns, and locks your .npmrc permissions. Open source the core, charge $9/month for a team dashboard.
Example: A dev in Nairobi built a similar “hardening script” for Docker after the Docker Hub token leak. Open-sourced it on GitHub, got 2,400 stars in a month, then launched a hosted version at $12/month. Making ~$800/month from 67 teams.
📖 Hustle 4: Write the 'npm Supply Chain Security' Course
Look, there is no good, up-to-date course on npm supply chain security. Not one that covers ICP canister dead drops, not one that covers self-propagating worms, not one that shows you how to actually pin GitHub Actions to SHAs. The field moves faster than the educational content.
Record 8-10 videos, put it on Gumroad or Udemy. Price it at $49. Every DevSecOps team lead will buy it for their juniors.
Example: A security researcher in Bucharest recorded a “GitHub Actions Security” course after the Codecov breach. 12 videos, $39 on Gumroad. Sold 380 copies in 3 months. $14,820. Still sells ~20 copies/month passively.
⚡ Hustle 5: Start a 'Supply Chain Threat Intel' Newsletter
Every week, curate the latest supply chain attacks, compromised packages, and new attack techniques. Free tier gets a summary. Paid tier ($8/month) gets IOCs, YARA rules, and a “packages to avoid this week” list. Target: security teams at startups who can’t afford Snyk Enterprise.
Example: A threat intel analyst in Berlin started a “Malware Monday” newsletter focused on npm/PyPI malware. 1,200 free subscribers in 2 months. Converted 90 to paid at €7/month. That’s €630/month for writing one email a week.
🛠️ Follow-Up Actions
| Step | Action | Tool/Resource |
|---|---|---|
| 1 | Check if you used any affected Trivy versions (March 19-21) | trivy-action commit history on GitHub |
| 2 | Rotate ALL npm tokens in your org immediately | npm token list → npm token revoke |
| 3 | Pin GitHub Actions to commit SHAs, not tags | Replace @v1 with @abc123def |
| 4 | Enable npm package provenance | --provenance flag on publish |
| 5 | Audit your CI for hardcoded secrets | Use trufflehog or gitleaks (not Trivy, obviously) |
| 6 | Set up Aikido Security’s free scanner for npm | aikido.dev |
| 7 | Subscribe to npm advisories | npm audit + GitHub Dependabot alerts |
Quick Hits
| Want… | Do… |
|---|---|
 Check if you’re affected |
Run npm ls against the 47 package list, check Trivy versions from March 19-21 |
 Stop this from happening again |
Pin every GitHub Action to a commit SHA, not a version tag |
 Make money from this chaos |
Build a token audit tool or sell supply chain hardening services |
 Understand ICP canister dead drops |
Read Aikido Security’s full writeup — it’s the first documented case |
 Rotate tokens fast |
npm token list, revoke everything, generate new short-lived tokens |
Your vulnerability scanner had a vulnerability. Your security tool needed securing. The npm install that was supposed to protect you? It was the attack vector. Sleep well.
!