Reference #18.4a200117.1774082881.3ae6c18
https://errors.edgesuite.net/18.4a200117.1774082881.3ae6c18
Reference #18.4a200117.1774082881.3ae6c18
https://errors.edgesuite.net/18.4a200117.1774082881.3ae6c18
Reference #18.49200117.1774089359.3ea257c
https://errors.edgesuite.net/18.49200117.1774089359.3ea257c
Japan sources more than 90 percent of its crude oil imports from the Middle East and is heavily dependent on exports transiting the key waterway.
Published On 21 Mar 2026
Iran says Japanese ships will be allowed to transit the Strait of Hormuz, in the latest sign that Tehran has started pursuing a selective blockade of the strategic waterway.
“We have not closed the strait. In our opinion, the strait is open. It is closed only to ships belonging to our enemies, countries that attack us. For other countries, ships can pass through the strait ,” Iranian Foreign Minister Abbas Araghchi told Japan’s Kyodo News late on Friday.
“We are talking to them to find a way to pass safely. We are ready to provide them with safe passage. All they need to do is contact us to discuss how this route will be,” Araghchi said, according to an English transcript of the interview shared on his Telegram account.
Japan sources more than 90 percent of its crude oil imports from the Middle East and is heavily dependent on exports transiting the strait, but the waterway has been de facto closed since the United States and Israel attacked Iran on February 28.

Iran’s Islamic Revolutionary Guard Corps (IRGC) warned in the early days of the war that its forces would set “ablaze” any ships trying to transit the waterway, bringing marine traffic to a near standstill.
Over the past week, however, Iran has toned down the rhetoric to say the strait is only closed to Tehran’s enemies.
Japan may soon join the small cohort of countries – mainly China, India, and Pakistan – whose vessels have been allowed to transit the waterway in recent days, with approval from Iranian authorities.
Lloyd’s List, a shipping and maritime information service, separately reported that 10 ships have transited the strait by sailing close to Iran’s coastline – a route that is emerging as a “safe corridor” for shipping.
The latest ship, a Greek bulk carrier, transited on Friday by passing close to Iran’s Larak island , Lloyd’s said, while broadcasting the message “Cargo Food for Iran”.
While ships have been transiting on a case-by-case basis, Lloyd’s List reported that the IRGC is developing a more coordinated vetting and registration system.
As the war on Iran hits three weeks, a handful of countries – among them US allies – have already started lobbying Tehran to reopen the strait or allow their ships safe passage.
Japan, France, Germany, Italy, the Netherlands, and the United Kingdom earlier this week issued a joint statement expressing their “readiness to contribute to appropriate efforts to ensure safe passage through the Strait”.
Iraq, Malaysia, China, India and Pakistan have all reportedly held direct talks with Tehran to discuss the matter, according to Lloyd’s.
Araghchi’s remarks to Kyodo follow a call with Japanese Foreign Minister Toshimitsu Motegi on Tuesday, during which Tokyo expressed concern about the large number of Japanese vessels currently stranded in the Gulf, according to a Japanese readout of the call.
United States President Donald Trump says he is considering “winding down” the military operations in Iran even as his administration deploys 2,500 additional marines to the region and asks Congress for more money to fund the war.
In a social media post on Friday, Trump said the US was “getting very close to meeting our objectives as we consider winding down our great Military efforts in the Middle East”.
The mixed messages from Trump came after another climb in oil prices plunged the US stock markets. His administration also announced that it was lifting sanctions on Iranian oil already loaded on ships, a move aimed at wrangling the soaring fuel prices.
White House Press Secretary Karoline Leavitt, in a post on X shortly after Trump’s message, said “the President and the Pentagon predicted it would take approximately 4-6 weeks to achieve this mission.
“Tomorrow [Saturday] marks week 3 – and the US Armed Forces are doing an exceptional job,” Leavitt wrote. “Day by day, the Iranian Regime is being crippled, and their ability to threaten the United States and our allies is being significantly weakened.”
Al Jazeera’s Rosiland Jordan, reporting from Washington, said four to six weeks is “the new number coming from the Trump administration about when Operation Epic Fury could possibly end”.
“The White House has never been clear since the war began on February 28 about just how long the war was going to take, how many different platforms it would be fought on, and what would be the final metric for the US deciding to declare victory,” she said.
But the three-week-old war has shown no signs of abating, with the US-Israeli forces attacking the Iranian capital, Tehran, and nearby areas as the country welcomed the first day of the Persian new year, Nowruz. At least two people were killed by shelling on a residential area in the village of Dastak in northern Iran’s Kiashahr, Gilan province’s governor said.
Meanwhile, Iran fired two ballistic missiles at the Diego Garcia military base in the Indian Ocean, run jointly by the US and the United Kingdom, the semi-official Mehr news agency reported on Saturday.
Israel said Iranian forces continued to fire missiles at it early on Saturday, while Saudi Arabia said it downed 20 drones in just a couple of hours in the country’s eastern region – home to major oil installations.
The US and Israel have offered shifting rationales for the war at different times, from hoping to foment an uprising that topples Iran’s leadership to eliminating its nuclear and missile programmes.
While Trump claimed the US is “very close” to meeting the war’s objectives, his administration is moving to bolster its firepower in the region and request another $200bn from Congress to fund the war.
Earlier this week, the US redirected another group of amphibious assault ships carrying 2,500 marines from the Pacific to the Middle East. The marines will join more than 50,000 US troops already in the region.
Trump has said he has no plans to send ground forces into Iran, but has also asserted that he retains all options.
Iran’s Supreme Leader Mojtaba Khamenei on Friday said Iran has dealt “a dizzying blow” to its enemies and that the US-Israeli war on his country was a “gross miscalculation”.
In a written statement read on Iranian television to mark Nowruz, Khamenei praised the Iranians’ steadfastness in the face of war. Khamenei has not been seen in public since he became the supreme leader following the Israeli strikes that killed his father, Ayatollah Ali Khamenei, and reportedly wounded him.
More than 1,400 people have been killed in Iran during the war, according to the authorities, while Israeli bombing has killed more than 1,000 people in Lebanon. In Israel, at least 18 people have been killed by Iranian missiles, while at least 13 US soldiers have died so far, according to officials.
Reference #18.49200117.1774096909.406e74d
https://errors.edgesuite.net/18.49200117.1774096909.406e74d
Reference #18.6e560e17.1774082541.76d836e
https://errors.edgesuite.net/18.6e560e17.1774082541.76d836e
The threat actors behind the supply chain attack targeting the popular Trivy scanner are suspected to be conducting follow-on attacks that have led to the compromise of a large number of npm packages with a previously undocumented self-propagating worm dubbed CanisterWorm.
The name is a reference to the fact that the malware uses an ICP canister, which refers to tamperproof smart contracts on the Internet Computer blockchain, as a dead drop resolver. The development marks the first publicly documented abuse of an ICP canister for the explicit purpose of fetching the command-and-control (C2) server, Aikido Security researcher Charlie Eriksen said.
The list of affected packages is below –
The development comes within a day after threat actors leveraged a compromised credential to publish malicious trivy, trivy-action, and setup-trivy releases containing a credential stealer. A cloud-focused cybercriminal operation known as TeamPCP is suspected to be behind the attacks.
The infection chain involving the npm packages involves leveraging a postinstall hook to execute a loader, which then drops a Python backdoor that’s responsible for contacting the ICP canister dead drop to retrieve a URL pointing to the next-stage payload. The fact that the dead drop infrastructure is decentralized makes it resilient and resistant to takedown efforts.
“The canister controller can swap the URL at any time, pushing new binaries to all infected hosts without touching the implant,” Eriksen said.
Persistence is established by means of a systemd user service, which is configured to automatically start the Python backdoor after a 5-second delay if it gets terminated for some reason by using the “Restart=always” directive. The systemd service masquerades as PostgreSQL tooling (“pgmon”) in an attempt to fly under the radar.
The backdoor, as mentioned before, phones the ICP canister with a spoofed browser User-Agent every 50 minutes to fetch the URL in plaintext. The URL is subsequently parsed to fetch and run the executable.
“If the URL contains youtube[.]com, the script skips it,” Eriksen explained. “This is the canister’s dormant state. The attacker arms the implant by pointing the canister at a real binary, and disarms it by switching back to a YouTube link. If the attacker updates the canister to point to a new URL, every infected machine picks up the new binary on its next poll. The old binary keeps running in the background since the script never kills previous processes.”
It’s worth noting that a similar youtube[.]com-based kill switch has also been flagged by Wiz in connection with the trojanized Trivy binary (version 0.69.4), which also reaches out to the same ICP canister via a Python dropper (“sysmon.py”). As of writing, the URL returned by the C2 is a rickroll YouTube video.
The Hacker News found that the ICP canister supports three methods – get_latest_link, http_request, update_link – allowing the threat actor to modify the behavior at any time to serve an actual payload.
In tandem, the packages come with a “deploy.js” file that the attacker runs manually to spread the malicious payload to every package a stolen npm token provides access to in a programmatic fashion. The worm, assessed to be vibe-coded using an artificial intelligence (AI) tool, makes no attempt to conceal its functionality.
“This isn’t triggered by npm install,” Aikido said. “It’s a standalone tool the attacker runs with stolen tokens to maximize blast radius.”
To make matters worse, a subsequent iteration of CanisterWorm detected in “@teale.io/eslint-config” versions 1.8.11 and 1.8.12 has been found to self-propagate on its own without the need for manual intervention.
Unlike “deploy.js,” which was a self-contained script the attacker had to execute with the pilfered npm tokens to push a malicious version of the npm packages to the registry, the new variant incorporates this functionality in “index.js” within a findNpmTokens() function that’s run during the postinstall phase to collect npm authentication tokens from the victim’s machine.
The main difference here is that the postinstall script, after installing the persistent backdoor, attempts to locate every npm token from the developer’s environment and spawns the worm right away with those tokens by launching “deploy.js” as a fully detached background process.
Interestingly, the threat actor is said to have swapped out the ICP backdoor payload for a dummy test string (“hello123”), likely to ensure that the entire attack chain is working as intended before adding the malware.
“This is the point where the attack goes from ‘compromised account publishes malware’ to ‘malware compromises more accounts and publishes itself,'” Eriksen said. “Every developer or CI pipeline that installs this package and has an npm token accessible becomes an unwitting propagation vector. Their packages get infected, their downstream users install those, and if any of them have tokens, the cycle repeats.”
(This is a developing story. Please check back for more details.)
Reference #18.49200117.1774080251.3d0ccbd
https://errors.edgesuite.net/18.49200117.1774080251.3d0ccbd
Reference #18.4a200117.1774080599.3a50819
https://errors.edgesuite.net/18.4a200117.1774080599.3a50819
Reference #18.49200117.1774099121.4126953
https://errors.edgesuite.net/18.49200117.1774099121.4126953