MAL-WORM Self-Propagation and Spread
The spread step of the npm-worm class: source that uses a harvested publish or CI token to propagate, by re-publishing poisoned packages, stamping a malicious workflow into other repositories, pushing commits, or dumping the loot into an attacker-controlled gist.
What Vulkro detects
MAL-WORM-001 fires when a publish or CI token harvest (NPM_TOKEN, GITHUB_TOKEN / GH_TOKEN, an .npmrc _authToken) and a propagation sink (npm publish, a gists API call, an Octokit gists.create, a git push / git remote add, or code that writes a .github/workflows/*.yml file) fall within a small window of source lines in the same file.
Either half alone is unremarkable: a CI script reads NPM_TOKEN and release tooling runs npm publish. It is the two adjacent, in a repository the author controls, that describes a spread routine.
False-positive discipline: files that are clearly benign release automation (semantic-release, changesets, release-please, lerna) are allow-listed, because legitimate release tooling reads a publish token and publishes by design. The allow-list is kept deliberately tight, since an over-broad one would suppress real payloads. The two halves read different text: the harvest and propagation triggers match comment-stripped source, while the allow-list matches the raw text, because a header comment naming the release tool is real evidence.
What this does not claim: it is proximity, not dataflow. It does not prove the harvested token drives the propagation call. It never certifies code safe.
Remediation. If the file is not your release tooling, assume the token it reads is already spent: revoke the npm and GitHub tokens on that machine, audit recent publishes and workflow files in your repositories, and do not run the clone.
See also
- Confidence model - what
High,Medium, andLowmean for findings in this category. - Safety - what Vulkro does and does not access on your machine.
References
This page is generated by vulkro rules export <out-dir> from Vulkro's built-in detector catalogue. Edits made by hand are overwritten on the next regeneration.