Namastex Labs npm packages compromised by self-propagating CanisterWorm malware

On 21 April 2026, malicious releases of legitimate npm packages associated with Namastex Labs, including pgserve and Automagik Genie, were distributed through trusted package channels. Researchers found install-time malware that harvested developer, cloud, CI/CD, npm and PyPI credentials and was capable of using stolen publishing tokens to inject itself into additional packages. StepSecurity confirmed active exfiltration behavior during controlled analysis. The compromise therefore altered legitimate upstream software artifacts and created a direct software-supply-chain data-integrity impact for downstream installations.