IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks
Two npm supply chain attacks spread a Rust stealer and a new Miasma worm variant through poisoned packages and compromised accounts.
Intelligence analysis by GPT-5.4 Mini
JFrog says IronWorm turns stolen developer secrets into a propagation engine, while Endor Labs and StepSecurity report a separate Miasma wave that used a stealthy install-time trick to spread across dozens of npm packages.
Two sneaky computer bugs got into the software toy box that programmers use. One steals keys and passwords, then uses them to sneak into more projects, like a burglar copying a master key and making more copies.
Analysis
IronWorm
JFrog says the first campaign used poisoned npm packages and a Rust-based information stealer traced to a compromised npm account named asteroiddao. The malware runs through a preinstall hook, harvests secrets from developer machines, and can modify projects so it can spread again through GitHub. The stolen data includes environment variables, cloud and container credentials, vault settings, npm tokens, and wallet files.
The company also says the malware hides behind an eBPF kernel rootkit and talks to its operator over Tor. In GitHub, malicious commits were pushed across nine organizations using the author name claude, apparently to imitate Anthropic’s chatbot branding. JFrog says the malware could also replace GitHub Actions workflows so secrets are collected and uploaded as a build artifact, removing the need for a separate command-and-control server.
New Miasma variant
In a separate campaign, Endor Labs and StepSecurity say 57 npm packages were compromised across more than 286 malicious versions to deliver a new Miasma worm variant. StepSecurity says the attacker used a small binding.gyp file to trigger code execution during npm install, a technique it calls Phantom Gyp because it avoids the lifecycle scripts that security tools often watch.
The payload downloads Bun, then uses it to steal credentials from cloud services, GitHub, SSH, password managers, package registries, and AI assistants. The report says the malware can also plant persistent backdoor files that run when a developer opens a project in an AI-assisted IDE. Red Hat separately said the earlier Miasma incident likely began with a compromised GitHub account used to push unauthorized commits.
Key points
- JFrog says IronWorm spread through trojanized npm packages tied to a compromised account called `asteroiddao`.
- The malware steals a wide set of secrets, including cloud, container, npm, and AI tool credentials.
- It can rewrite GitHub Actions workflows and use stolen credentials to spread into more repositories.
- Endor Labs and StepSecurity reported a separate Miasma worm wave affecting 57 npm packages and 286+ malicious versions.
- The new Miasma variant uses a `binding.gyp` file to trigger install-time code execution and targets AI assistant configurations.
The reporting gives defenders concrete indicators and tactics to block, including compromised npm accounts, poisoned GitHub commits, and the `binding.gyp` trick. Teams that pin package hashes, rotate secrets, and harden install flows may reduce the chance of the same playbook spreading further.
If developers keep trusting compromised packages, the malware can keep moving through repositories and build systems with stolen credentials. The focus on AI assistant configs and CI environments means the attack can keep resurfacing even after a single package is removed.
