Self-Propagating npm Supply Chain Worm Targets AI Agent Packages
Self-Propagating npm Supply Chain Worm Targets AI Agent Packages is a critical-severity supply chain compromise issue in Multiple Namastex Labs npm packages, an AI agent. Affected: Multiple Namastex Labs npm packages (agentic AI tooling). It has been exploited in the wild.
Is Multiple Namastex Labs npm packages running on your developers' machines? Anomity finds every device with this AI agent installed, shows the version, and can block it by policy. Detect this across your developers' devices with Anomity →
Key facts
- ID
self-propagating-npm-supply-chain-worm-targets-ai-agent-packages- Severity
- critical
- Attack type
- Supply chain compromise, Credential theft, Malware
- Component
- Multiple Namastex Labs npm packages · AI agent
- Known exploited
- Yes
- Published
- Last verified
What is this vulnerability?
A self-spreading CanisterWorm-style malware strain was discovered in multiple npm packages from Namastex Labs, an agentic AI company. The worm hijacks npm packages to steal developer auth tokens and propagate to downstream dependencies. In a 48-hour window (April 21-23), three coordinated supply chain campaigns hit npm, PyPI, and Docker Hub, all targeting API keys, cloud credentials, SSH keys, and CI/CD tokens from developer environments.
Affected versions
| Affected | Fixed in |
|---|---|
Multiple Namastex Labs npm packages (agentic AI tooling) | No fixed version listed |
Am I affected by this vulnerability?
You are affected if you run Multiple Namastex Labs npm packages (agentic AI tooling).
How do I fix it?
Audit node_modules for Namastex Labs packages. Rotate npm tokens and cloud credentials. Enable npm 2FA and token scoping. Use lockfile-only installs in CI. Monitor for unexpected outbound connections from development environments.
How do I find every machine running Multiple Namastex Labs npm packages?
Anomity inventories the AI agents, MCP servers, IDE extensions and skills on each developer device, so you can see which machines run Multiple Namastex Labs npm packages and which version, then enforce a policy on it.