Self-Replicating npm Worm Hijacks Namastex Labs Packages to Steal Developer Secrets
A fresh supply chain attack is rippling across the npm ecosystem, and it does not just sit and wait. Researchers at Socket and StepSecurity have flagged at least 16 packages tied to Namastex Labs, an AI agent tooling company, that were quietly republished with malicious code built to harvest developer secrets and propagate to every other package the victim can publish.
The first poisoned release surfaced on April 21st, 2026, when a tainted version of pgserve hit the registry at 22:14 UTC, followed by two more the same day. The campaign quickly expanded into @automagik/genie, @fairwords/websocket, @fairwords/loopback-connector-es, @openwebconcept/theme-owc, @openwebconcept/design-tokens, and others. None are massive consumer libraries, but all are tightly woven into AI agent stacks, PostgreSQL workflows, and design system tooling, exactly the high-value developer environments the attackers want.
How the Worm Spreads
What sets this campaign apart is the self-propagation logic in the payload. Once a developer installs an infected version, the script hunts for npm publish tokens in environment variables and the ~/.npmrc file. If it finds one, it identifies which packages that token can publish, injects itself, bumps the version, and pushes the poisoned release back to npm. The next victim installs it, and the blast radius grows on its own.
The malware is not picky about ecosystems. If PyPI credentials are present, it pivots to Python and uses a .pth-based payload to drop itself into Python packages the victim controls, turning the incident into a multi-ecosystem worm.
What the Payload Steals
Socket’s analysis describes a four-job payload, starting with secret harvesting. The script scrapes environment variables tied to tokens, API keys, cloud providers, CI/CD systems, registries, and LLM platforms, then pulls high-value files from disk: .npmrc, SSH keys and config, .git-credentials, .netrc, AWS, Azure, and GCP credentials, Kubernetes and Docker configs, Terraform, Pulumi, and Vault material, and database password files.
The malware also targets Chrome and Firefox profiles, including browser-stored data for crypto wallet extensions like MetaMask, Exodus, Atomic Wallet, and Phantom. Everything is exfiltrated off-host through canister-backed infrastructure on the Internet Computer Protocol, a dead-drop command and control channel matching earlier CanisterWorm activity attributed to TeamPCP.
Same Tradecraft, Open Question on Attribution
Socket noted that the malicious code contains an explicit reference to a TeamPCP/LiteLLM method, and the techniques for credential theft, exfiltration, and self-propagation closely mirror the prior CanisterWorm campaign. The canister in this incident is not the same one used previously, and the upstream cause, whether a stolen maintainer token, a compromised CI/CD pipeline, or something else, is still under investigation. Researchers stop short of confident attribution, but the family resemblance is hard to miss.
What Defenders Should Do Right Now
Both Socket and StepSecurity are urging teams to treat every listed version as malicious and remove them from dev machines and CI/CD pipelines immediately. After that, rotate everything: npm tokens, cloud provider keys, SSH keys, git credentials, registry tokens, LLM API keys, and anything else that may have been in an env var or dotfile when an infected install ran.
Internal package mirrors, build artifacts, and dependency caches need scrubbing too, since a poisoned tarball cached in a corporate proxy will reinfect the next developer who pulls it. Socket also recommends hunting for related packages that share the same public.pem file, webhook host, or postinstall pattern, since those overlaps are how researchers connected this incident to the broader CanisterWorm cluster.
Treat Publish Tokens Like Production Secrets
Self-replicating supply chain malware has graduated from thought experiment to recurring headline, and the Namastex incident shows why long-lived npm publish tokens sitting in plaintext on developer laptops and CI runners are effectively pre-positioned worm fuel. When a single token can publish to a dozen packages, it represents a dozen breaches in waiting.
Publish credentials deserve the same treatment as production secrets: tightly scoped, short-lived or granular, protected by 2FA, and kept off developer workstations whenever possible. Combined with build-time integrity checks, lockfile reviews, and disciplined postinstall script hygiene, those controls are what separate organizations that absorb the next CanisterWorm variant from those that become its next host.
Sources: Socket | BleepingComputer
