Back Thehackernews

Trivy Supply Chain Attack Triggers Self

Thehackernews •[email protected] (The Hacker News) • March 21, 2026

The threat actors behind the supply chain attack targeting the popular Trivy scanner are suspected to be conducting follow-on attacks that have led to the compromise of a large number of npm packages with a previously undocumented self-propagating worm dubbed CanisterWorm. The name is a reference to the fact that the malware uses an ICP canister, which refers to tamperproof smart contracts on

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

CanisterWorm: New Self-Propagating Worm Targets NPM Packages Post-Trivy Attack On March 20, 2026, a new worm named CanisterWorm was detected compromising numerous NPM packages, following a prior attack on the Trivy scanner. The threat actor, TeamPCP, is believed to be behind both attacks. CanisterWorm utilizes an ICP Canister for its command and control (C2) operations, marking a novel approach in malware deployment. The worm exploits npm tokens to self-propagate, significantly increasing its reach and impact. Initial payloads included a backdoor that installs a persistent service, while later versions introduced functionality to harvest npm tokens from compromised systems. The attack escalated from a single compromised account to a widespread infection vector, affecting developers and CI pipelines that use the targeted packages. Current status indicates ongoing risks as the worm continues to spread through infected packages. Security professionals are urged to monitor their systems for signs of infection. 5 sources 70

Extracted Entities

Trivy Supply Chain Attack Triggers Self

The full story

Extracted Entities

Attack Types (2)

Campaigns (1)

Malware (1)

Tools (2)