Malware - Trivy Supply Chain Attack Spreads CanisterWorm

What Happened

A significant supply chain attack has targeted the popular Trivy scanner, leading to the emergence of a self-propagating worm known as CanisterWorm. This malware has infiltrated 47 npm packages, affecting numerous developers and their projects. The attackers, suspected to be part of a cloud-focused operation called TeamPCP, exploited compromised credentials to publish malicious versions of Trivy, which included a credential-stealing component.

The CanisterWorm utilizes an ICP canister, a feature of the Internet Computer blockchain, as a means to fetch commands from its command-and-control (C2) server. This marks a notable first in the documented use of an ICP canister for malware distribution. The infection process is initiated through a postinstall hook that executes a loader, which then drops a Python backdoor responsible for further malicious activities.

Who's Being Targeted

The attack primarily targets developers who utilize npm packages, particularly those linked to the compromised Trivy scanner. The affected packages include:

• 28 packages in the @EmilGroup scope
• 16 packages in the @opengov scope
• Other notable packages like @teale.io/eslint-config and @airtm/uuid-base32.

As the worm propagates, it seeks out npm authentication tokens from the victims' environments. This means that any developer or CI pipeline that installs these packages and has an accessible npm token becomes a potential vector for further infections. The cycle of infection can continue as more developers install the compromised packages, leading to widespread consequences.

Signs of Infection

Indicators of infection include the presence of a Python backdoor that connects to the ICP canister every 50 minutes. The backdoor masquerades as legitimate PostgreSQL tooling, making it harder to detect. Additionally, the worm's ability to self-propagate means it can spread without manual intervention, making it even more dangerous.

The malware's functionality is not hidden; it openly attempts to locate every npm token from the developer's environment. If successful, it launches a script that propagates the worm, potentially infecting more packages and users in the process.

How to Protect Yourself

To mitigate the risks associated with this malware, developers should take immediate action:

• Audit npm packages: Review and update npm packages to ensure they are not compromised.
• Monitor for unusual activity: Keep an eye on your development environment for any unauthorized changes or unexpected connections.
• Use secure credentials: Ensure that npm tokens and other credentials are stored securely and rotated regularly.

Furthermore, consider implementing security measures such as code signing and dependency scanning to identify vulnerabilities in your software supply chain. Staying informed about the latest threats and adopting best practices can help safeguard your development environment against attacks like CanisterWorm.