Skip to content
AgentProv

2026-04-21 · 2026-Q2

CanisterSprawl Self-Propagating npm Worm via Namastex Labs and pgserve

Primary layerL1 CredentialSecondary:L4 Code / Package

Should this run hold this key at all?

The question layer 1 asks, and failed here.
Fixable
Vendor patch
Vendor response
Unknown
In the wild
Yes
Actor
Attacker

Target

Namastex Labs npm publisher namespaces and pgserve (embedded PostgreSQL for Node.js development)

Impact

At least 16 malicious package versions across linked namespaces; pgserve releases 1.1.11, 1.1.12, and 1.1.13 (April 21 starting 22:14 UTC) carried a postinstall hook that harvested npm publish tokens, AWS, GCP, Azure, and Kubernetes credentials, SSH keys, and AI tooling configuration, then republished poisoned versions of every package the victim could publish; if a PyPI token was found, the worm jumped to PyPI; data exfiltrated both to a webhook (`telemetry.api-monitor.com`) and to ICP canister `cjn37-uyaaa-aaaac-qgnva-cai.raw.icp0.io`

Root cause

Compromised maintainer credentials at Namastex Labs (a vendor of agentic AI tooling) plus npm's allowance of postinstall hooks; ICP canister IDs cannot be removed via registrar takedowns or DNS sinkholing, blunting law-enforcement response

Sources

Catalog

View this entry in the catalog

Cite this: AgentProv incident record: CanisterSprawl Self-Propagating npm Worm via Namastex Labs and pgserve (2026-04-21). https://agentprov.com/incidents/2026-04-21-canistersprawl-self-propagating-npm-worm-via-namastex-labs-and-pgserve

Related