Something new and genuinely unsettling landed in the npm ecosystem this week. Researchers at Socket and StepSecurity independently identified a supply chain attack — tracked as CanisterSprawl — that doesn't just infect packages and wait. It actively spreads itself.

Here's how it works. Malicious code embedded in compromised npm packages steals the developer's authentication tokens. It then uses those stolen credentials to publish further poisoned packages under the victim's own account — turning every compromised developer into an unwitting distribution node. The stolen tokens are exfiltrated to an ICP (Internet Computer Protocol) canister, a decentralised backend that's harder to take down than a traditional command-and-control server. Think of it as ransomware logic applied to a package registry: each new victim becomes part of the infection apparatus.

This is qualitatively different from the typical supply chain compromise, where an attacker quietly slips malicious code into a popular library and waits for downstream developers to pull it in. CanisterSprawl has a self-propagation mechanism — a worm, in the classical sense. That's a meaningful escalation in the threat model for open-source ecosystems.

The npm registry is a spectacularly attractive target. It hosts over three million packages and sees billions of downloads a week. Even a modestly popular package with a poisoned dependency can reach tens of thousands of development environments almost instantly. And because developers generally trust packages published by known maintainers, a token-theft-and-republish attack is almost perfectly camouflaged — the provenance looks legitimate because it technically is.

The ICP canister choice for exfiltration is worth noting. Blockchain-based infrastructure is increasingly being exploited for C2 and data theft precisely because traditional security tooling struggles with it. You can't just null-route a domain or take down a server. It's a technique that's been maturing quietly, and CanisterSprawl appears to be one of the more sophisticated deployments seen in the wild.

What defenders should do right now: audit your npm token permissions and rotate any that aren't scoped to the minimum necessary access. Enable npm's granular token controls and consider requiring publish attestation for any packages your organisation maintains. If you run a CI/CD pipeline, treat your npm tokens like production secrets — because attackers already do.

This also lands the same week that malicious Docker images were pushed to the official Checkmarx KICS repository on Docker Hub, overwriting existing tags with trojanised versions. The timing is coincidental but illustrative: software supply chains are under sustained, coordinated pressure from multiple directions simultaneously.

The broader question this raises is whether current SBOM (Software Bill of Materials) practices are keeping pace. A separate analysis published this week argues they're not — that SBOMs generate plenty of data but lack the governance layer needed to turn that data into actionable decisions. CanisterSprawl is a perfect illustration of the gap: your SBOM tells you what's in your dependency tree, but it won't flag that the publisher's account was hijacked and the package was re-signed with stolen credentials five minutes ago.

Watch for: whether npm (owned by GitHub, owned by Microsoft) introduces stricter publish-flow controls in response, and whether the ICP community takes action against canisters used for malicious exfiltration. Neither has a strong precedent for rapid intervention here.