Self-propagating worm in developer tooling delivers multi-stage malware

Research from Aikido describes a supply chain attack in which compromised developer tooling and package ecosystems were used to distribute a self-propagating worm. The worm harvested credentials, including tokens and CI/CD secrets, and used them to spread further by publishing additional malicious packages. This ultimately led to delivery of a multi-stage payload known as CanisterWorm. The malware establishes command-and-control communication, maintains persistence and adapts its behaviour to the environment it finds itself in.

What this means for your organisation

The self-propagating pattern is what makes this class of attack difficult: every compromised secret becomes new compromised packages, and spread outpaces manual cleanup. Environment-aware behaviour also means the malware can stay quiet in test environments and surface only where there is most to gain. For organisations doing their own development, secrets in the build chain must be treated as a first-order risk.

Berigo recommends

• Rotate all tokens and secrets that may have been exposed in build environments.
• Require that packages are published via controlled accounts with multi-factor authentication.
• Isolate build agents so they hold no standing access to production or publishing rights.
• Establish logging and alerting when new package versions are published from your own accounts.

Source

• aikido.dev
• aikido.dev