# CanisterSprawl: self-propagating npm worm hits pgserve + Namastex packages

> Socket and StepSecurity disclosed CanisterSprawl, a self-propagating npm worm that compromised at least 16 versions across Namastex Labs and related publishers from 21 April 2026. The postinstall hook harvests 38 env vars and filesystem secrets, encrypts via AES-256-CBC + RSA-4096, and exfiltrates to an Internet Computer Protocol canister. Stolen npm tokens are reused to publish further malicious versions. Tradecraft matches the earlier TeamPCP CanisterWorm campaign.

- Published: 2026-04-21
- Severity: critical
- Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- Ecosystems: npm
- Scope: 6 packages, 16 compromised versions
- Tags: worm, credential-theft, maintainer-takeover, infostealer, obfuscation
- Also known as: CanisterSprawl, CanisterWorm variant
- Detected by: StepSecurity, Socket
- Incident ID: npm-2026-04-21-canisterworm-pgserve-namastex

## Affected packages (6)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [@automagik/genie](https://dependencywatch.io/package/npm/@automagik/genie) | npm | 4.260421.33, 4.260421.34, 4.260421.35, 4.260421.36, 4.260421.37, 4.260421.38, 4.260421.39 |
| [@fairwords/loopback-connector-es](https://dependencywatch.io/package/npm/@fairwords/loopback-connector-es) | npm | 1.4.3, 1.4.4 |
| [@fairwords/websocket](https://dependencywatch.io/package/npm/@fairwords/websocket) | npm | 1.0.38, 1.0.39 |
| [@openwebconcept/design-tokens](https://dependencywatch.io/package/npm/@openwebconcept/design-tokens) | npm | 1.0.3 |
| [@openwebconcept/theme-owc](https://dependencywatch.io/package/npm/@openwebconcept/theme-owc) | npm | 1.0.3 |
| [pgserve](https://dependencywatch.io/package/npm/pgserve) | npm | 1.1.11, 1.1.12, 1.1.13 |

## What happened

StepSecurity and Socket disclosed **CanisterSprawl** on April 21, 2026 - a self-propagating npm worm focused on Namastex Labs and adjacent publishers. At least 16 malicious versions were published across `pgserve`, `@automagik/genie`, `@fairwords/websocket`, `@fairwords/loopback-connector-es`, and the `@openwebconcept` design-token packages.

The `postinstall` hook harvests 38 environment-variable names plus filesystem secrets (SSH private keys, `.npmrc`, `.aws/credentials`, Chrome saved passwords). The data is encrypted with AES-256-CBC under a randomly-generated key, the key is sealed with the attacker's RSA-4096 public key, and the bundle is uploaded to an **Internet Computer Protocol (ICP) canister** rather than a normal HTTP endpoint. ICP canisters are immune to conventional domain-takedown, which is the operational point of using one as a drop.

Stolen npm tokens are immediately reused to publish new malicious versions of any other package the maintainer can publish to, which is how the worm hopped from Namastex into the Fairwords and OpenWebConcept namespaces. The tradecraft - env-var list, encryption layout, ICP canister exfil - matches the earlier TeamPCP **CanisterWorm** campaign closely enough that StepSecurity considers it the same operator infrastructure even though TeamPCP did not publicly claim this one.

If you resolved any affected version, rotate every npm token, cloud key, and SSH credential present on the machine, then block egress to `*.raw.icp0.io` and `telemetry.api-monitor.com`.

## Impact

- Steals npm tokens, AWS/GCP/Azure credentials, SSH keys, Chrome passwords
- Self-replicates to additional packages via stolen publish tokens
- Exfiltration to ICP canister immune to domain takedown
- Python `.pth`-based PyPI lateral path if PyPI creds are found

## What to do

1. Remove the listed versions and downgrade to the last legitimate release
2. Rotate every npm token, cloud key, and SSH credential present on affected machines
3. Block egress to `*.raw.icp0.io` and `telemetry.api-monitor.com`

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [StepSecurity: pgserve compromised on npm](https://www.stepsecurity.io/blog/pgserve-compromised-on-npm-malicious-versions-harvest-credentials) - StepSecurity
- [Socket: CanisterSprawl npm worm](https://socket.dev/blog/canisterworm-npm-publisher-compromise-deploys-backdoor-across-29-packages) - Socket

---

Canonical page: https://dependencywatch.io/incident/npm-2026-04-21-canisterworm-pgserve-namastex
Markdown version: https://dependencywatch.io/incident/npm-2026-04-21-canisterworm-pgserve-namastex.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).