CanisterWorm malware hits npm, PyPI ecosystems

A self-replicating supply chain attack is actively compromising npm packages to exfiltrate developer authentication tokens. The malicious code automatically injects itself into newly published packages once a developer machine is infected, creating an autonomous propagation cycle across the JavaScript ecosystem. This worm's ability to autonomously spread through legitimate publishing workflows represents an evolution in supply chain threat vectors. Stolen tokens enable persistent access to package repositories, allowing attackers to poison widely-used dependencies at scale without requiring repeated manual compromise. This campaign appears distinct from the previously reported CanisterWorm malware, which targeted both npm and PyPI ecosystems.