[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fV31tboXBXHoK1FMIySG8OGAgTF3SvyKt5guCUszZwPM":3},{"article":4,"iocs":50},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"full_text":11,"url":12,"image_url":13,"published_at":14,"ingested_at":15,"relevance_score":16,"entities":17,"category_id":29,"category":30,"article_tags":34},"7ddeeab3-5888-4295-b299-2774995e1d30","New IronWorm malware hits 36 packages in npm supply-chain attack","new-ironworm-malware-hits-36-packages-in-npm-supply-chain-attack-44cd69","A new supply-chain attack has infected 36 packages on the Node Package Manager (npm) index with infostealer malware called IronWorm. [...]","A new Rust-based infostealer malware called IronWorm has infected 36 npm packages in a supply-chain attack discovered by JFrog researchers. The malware targets environment variables and credential files (OpenAI, AWS, Anthropic, npm, SSH keys, cryptocurrency wallets) and self-propagates using stolen npm credentials, including Trusted Publishing tokens. The attack originated from a compromised account 'asteroiddao' and employs sophisticated evasion tactics including an eBPF kernel rootkit, Tor communication, and backdated Git commits.","IronWorm malware compromises 36 npm packages in supply-chain attack targeting developer credentials.","New IronWorm malware hits 36 packages in npm supply-chain attack By Bill Toulas June 4, 2026 11:25 AM 0 A new supply-chain attack has infected 36 packages on the Node Package Manager (npm) index with infostealer malware called IronWorm. The malware targets 86 environment variables (key-value pairs) and 20 credential files that may contain OpenAI, AWS, Anthropic, and npm credentials, vault configuration files, SSH keys, and Exodus cryptocurrency wallet files. According to researchers at supply-chain and devops company JFrog, IronWorm is written in Rust, hides behind an eBPF kernel rootkit, and communicates with the operator over the Tor network. The Rust-based malware self-propagates by using stolen credentials for publishing on npm; this includes secrets associated with npm's Trusted Publishing workflow. Once it compromises a developer or CI environment, it can publish trojanized versions of packages owned by the victim, which then infect additional developers and CI systems. This behavior is conceptually similar to Shai Hulud, which had its code published on GitHub recently. Although JFrog researchers did not find a clear connection between IronWorm and Shai Hulud, they observed the same commit names in both supply-chain attacks. This opens the possibility that the new malware is an evolution of TeamPCP’s payload, since IronWorm appears to be \"a custom, carefully built implant from an operation with its own infrastructure.\" According to JFrog, the latest attack started from a compromised account named ‘asteroiddao,’ which published package versions containing the Rust ELF binary executed via ‘preinstall,’ pushing malicious commits into repositories. The commit author appears as “claude,” and the timestamps point to several years ago, up to 13 years in some cases, even though they were pushed in the past few days. This is likely to evade investigation. One notable element in JFrog’s findings is a mechanism that relies on GitHub Actions to deliver the stolen secrets. JFrog explains that the malware serializes the secrets into a single value and then \"writes it to a file with a harmless-looking name, as if it were lint or formatting output.\" The last step of the process is uploading the file as a build artifact, which can be downloaded by anyone with access. This way, the threat actor can avoid the need for an external command-and-control (C2) altogether. However, the researchers note that this delivery mechanism has not been used in the analyzed IronWorm supply-chain attack. Another peculiarity discovered is that the operator hardcoded the recovery phrase of their own cryptocurrency wallet. The researchers say that the only reason for this is that the threat actor did not want the malware to steal it during the test stage. Application security company Ox Security says that the IronWorm attack was detected very early and stopped before it spread to more popular packages on npm. The company provides a list of all impacted package names and their versions in the report and recommends that developers upgrade to fixed releases, rotate their keys, and enable two-factor authentication (2FA) for all accounts. At the same time, Endor Labs and StepSecurity have spotted a very similar but distinct attack involving a JavaScript-based malware named binding.gyp, performing registry poisoning and GitHub Actions infection, unfolding during the same time-frame. Test every layer before attackers do Security teams log 54% of successful attacks and alert on just 14%. The rest move through your environment unseen.The Picus whitepaper shows how breach and attack simulation tests your SIEM and EDR rules so threats stop slipping by detection. Get the whitepaper Related Articles: New Shai-Hulud malware wave compromises 600 npm packagesShai Hulud attack ships signed malicious TanStack, Mistral npm packagesPopular node-ipc npm package compromised to steal credentialsNew npm supply-chain attack self-spreads to steal auth tokensDAEMON Tools devs confirm breach, release malware-free version","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fnew-ironworm-malware-hits-36-packages-in-npm-supply-chain-attack\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F06\u002F04\u002Fnpm.jpg","2026-06-04T15:25:37+00:00","2026-06-04T16:00:23.456247+00:00",9,[18,21,24,27],{"name":19,"type":20},"npm","technology",{"name":22,"type":23},"JFrog","vendor",{"name":25,"type":26},"TeamPCP","threat_actor",{"name":28,"type":20},"GitHub Actions","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":29,"icon":31,"name":32,"slug":33},null,"Supply Chain","supply-chain",[35,40,45],{"category":36},{"id":37,"icon":31,"name":38,"slug":39},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":41},{"id":42,"icon":31,"name":43,"slug":44},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":46},{"id":47,"icon":31,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51,54],{"type":39,"value":52,"context":53},"IronWorm","Rust-based infostealer malware targeting npm packages",{"type":39,"value":55,"context":56},"binding.gyp","JavaScript-based malware performing registry poisoning and GitHub Actions infection"]