Now I have what I need. Let me synthesize this for the roundtable.
Okay, here's my technical deep-dive. Four points, as requested.
(1) Self-Propagation vs. UNC1069 Axios
The Namastex worm is fundamentally different from UNC1069's social engineering playbook. UNC1069 hit Axios by compromising a single maintainer — classic pretexting, phishing, account takeover at the human layer. The Namastex campaign is autonomous worm propagation at the infrastructure layer.
Here's the kill chain:
- Entry:
postinstall hook in package.json fires automatically on npm install — no user interaction required. This is TTP T1195.002, Supply Chain Compromise: Malicious Package.
- Credential Harvest: The loader—typically
index.js or scripts/check-env.js—scans ~/.npmrc, /etc/npmrc, env vars matching NPM_TOKEN*, and runs npm config get to extract every publish credential on the machine. It's using the legitimate npm CLI against itself.
- Enumeration: Calls npm's registry API (
/-/whoami to identify token owner, then /-/user/org.couchdb.user:{username}/package to list every package that token has publish rights to).
- Replication: Downloads each legitimate tarball, injects the malicious
postinstall hook and payload, bumps patch version, and runs npm publish --tag latest. Each newly poisoned package becomes a fresh infection vector when downloaded by downstream consumers.
Critical distinction: UNC1069 needed a human to click a link. This worm propagates with zero user interaction and no social engineering—just code abusing code. Exponential, not linear, spread.
According to CERT/CC reporting, this mechanism had already compromised 16+ Namastex packages and was expanding into PyPI via .pth file injection—a technique that runs Python code on every interpreter startup without requiring an explicit import statement. Socket Security's analysis suggests the PyPI logic was present but less effective than the npm path due to missing Twine configurations in most environments.
{TOOL_RESULTS: search_threats() showing Namastex compromise details, web search confirming .pth technique from StepSecurity and SafeDep}
(2) ICP Canister C2 — Evasion Sophistication
This is genuinely novel, and it's going to get copied. The ICP (Internet Computer Protocol) canister isn't just a dead drop—it's a fully programmable, decentralized smart contract that can't be seized by any single provider or court order.
Three exposed methods run the operation:
get_latest_link: Returns current payload URL in plaintext
http_request: Serves it via HTTP-style polling
update_link: Allows the actor to rotate payload URLs on demand—without touching any infected package
Why this matters for evasion:
- No traditional infrastructure to dismantle. No domain registrar to notify, no hosting provider to subpoena. The C2 endpoint is
*.raw.icp0.io or similar, backed by blockchain consensus with nodes globally distributed.
- Dynamic retargeting. Actor can push new payloads, change exfil endpoints, or pivot infrastructure in real-time without republishing packages or re-compromising build pipelines.
- Resilient to sinkholing. You can't "seize" a blockchain canister the way you seize a domain.
I assess this as operational sophistication, not script-kiddie tooling. The ICP integration shows awareness of takedown dynamics that most crimeware operators ignore. According to StepSecurity and Socket analysis, the Namastex variant used canister ID cjn37-uyaaa-aaaac-qgnva-cai.raw.icp0[.]io/drop—a different canister from the original CanisterWorm (tdtqy-oyaaa-aaaae-af2dq-cai), suggesting either the same operators rotating infrastructure or copycats adopting the tradecraft.
{TOOL_RESULTS: ICP canister details from search_threats() and web search}
(3) Postinstall Hook Detection — SOC Hunt Artifacts
This is detectable, but you need to be looking during install-time, not post-compromise. The postinstall hook fires once, leaves little forensic residue unless you captured it live.
File Artifacts (Linux/macOS):
~/.config/systemd/user/pgmon.service — persistence service file (masquerades as PostgreSQL monitoring)
~/.local/share/pgmon/service.py — the Python backdoor itself
/tmp/pglog — staging file for second-stage payload downloads
/tmp/.pg_state — tracks last fetched payload URL to avoid re-execution
Memory/Behavioral Indicators:
npm or node processes spawning Python interpreters unexpectedly
- Processes making initial 5-minute sleep (sandbox evasion), then polling ICP endpoints every ~50 minutes
- Outbound HTTPS to
*.icp0.io, *.icp-api.io, or specific canister domains like ic0.app
- User-Agent spoofing (browser strings from system processes)
Command-line detection for SOC analysts:
# Check for persistence
systemctl --user status pgmon
# Hunt dropped payloads
find ~/.local/share ~/.config/systemd -name "*pgmon*" 2>/dev/null
# Monitor for abnormal npm-python process chains
auditctl -w /usr/bin/np -p x -k npm_exec
Critical gap: Most EDRs don't monitor npm install subprocess activity with sufficient granularity. The postinstall hook has full permissions of the installing user—often CI/CD runners with elevated cloud access.
{TOOL_RESULTS: Detection artifacts from web search, StepSecurity and Endor Labs reporting}
(4) xinference PyPI Vector — False Flag Assessment
My assessment: This is likely a genuine TeamPCP operation with strategic denial, not a copycat false flag.
The evidence chain:
| TTP |
xinference Incident |
Prior TeamPCP Campaign |
| Payload structure |
Base64-obfuscated Python passed to subprocess.Popen |
Identical—same detachment technique |
| Execution trigger |
import xinference (module __init__.py) |
.pth file injection for LiteLLM/Telnyx |
| Targeting |
AI/ML infrastructure (Xinference = model serving framework) |
Consistent—LiteLLM, Trivy, Checkmarx tools |
| Exfil envelope |
love.tar.gz staging, encryption, HTTPS webhook |
Same tradecraft observed in March campaign |
| Attribution marker |
# hacked by teampcp / #TeamPCP |
Present in prior samples |
| C2 infrastructure |
whereisitat.lucyatemysuperbox[.]space |
Rotating domains per operation |
Why I don't buy the copycat theory:
TeamPCP operates instructor-led supply chain campaigns with clear technical progression. The Trivy → LiteLLM → Telnyx → Namastex/xinference sequence shows increasing sophistication: GitHub Actions abuse → PyPI poisoning → npm worm propagation → cross-platform simultaneous deployment. Each wave iterates on the last.
The xinference payload differs in one respect only: no persistence mechanism. It harvests and exfiltrates, then exits. This suggests operational tempo over operational security—they prioritized speed and stealth (no persistent artifacts to find) over long-term access. That's consistent with a group that's learned that .pth persistence gets detected.
The denial itself is tradecraft. TeamPCP maintaining plausible deniability while observers document their code patterns serves their brand: they get the notoriety without the law enforcement heat. The "# hacked by teampcp" marker is too consistent across waves to be copycat work—copycats vary their signatures. TeamPCP maintains theirs.
Bottom line: Whether the same human hands typed the code or not, this is TeamPCP-tradecraft malware executing a TeamPCP-targeting pattern (AI/ML CI/CD infrastructure). Treat it as their campaign for defensive purposes.
Impact scope: 600K+ downloads across versions 2.6.0–2.6.2. JFrog's analysis shows the compromise happened via compromised XprobeBot commit access—suggesting the attack chain started with credential theft from automated publishing accounts, then propagated to the main package. This is the same pattern we saw with Trivy: compromise CI automation first, then escalate to package registries.
{TOOL_RESULTS: xinference compromise details from search_threats() and JFrog/OX Security reporting}
Summary: The Namastex worm is a step-function increase in supply chain threat—autonomous propagation replacing single-target social engineering. The ICP C2 infrastructure is resilient by design, not by accident. SOC teams need install-time visibility, not just runtime monitoring. And the xinference contamination is TeamPCP's work, denial notwithstanding—same code DNA, same targeting, same operational rhythm.
Patch rotation: immediate for any Namastex version published after April 21, immediate downgrade to xinference 2.5.0 for affected PyPI consumers. Don't wait for attribution certainty—assume compromise.