New IronWorm malware hits 36 packages in npm supply-chain attack
IronWorm infected 36 npm packages and tries to steal developer secrets, keys, and wallet files. It can also spread by publishing trojanized packages from compromised accounts.
Intelligence analysis by GPT-5.4 Mini
JFrog says a new Rust-based infostealer called IronWorm was found in 36 npm packages. The malware targets credentials and config files, hides behind an eBPF rootkit, and can self-propagate through npm publishing workflows.
A bad actor hid a sneaky program inside 36 software building blocks people download from npm. It tries to steal keys and passwords, then uses them like copied house keys to sneak into more places.
Analysis
What happened
Researchers at JFrog found a supply-chain campaign that infected 36 packages on npm with a new infostealer named IronWorm. The malware is written in Rust and is designed to collect sensitive data from developer systems and build environments.
What it targets
According to the article, IronWorm looks for 86 environment variables and 20 credential files. Those can contain OpenAI, AWS, Anthropic, and npm credentials, plus vault configuration files, SSH keys, and Exodus wallet files. That makes the attack relevant to both software supply chains and cryptocurrency theft.
How it spreads
JFrog says the malware uses stolen publishing credentials to post modified package versions back to npm, including credentials tied to npm’s Trusted Publishing flow. Once it compromises a developer or CI environment, it can push trojanized releases owned by the victim, which can then infect more systems. The article says this is conceptually similar to Shai Hulud, although JFrog did not confirm a direct link.
Operational details
The reported campaign began from a compromised account named asteroiddao, which published malicious package versions that ran a Rust ELF binary through preinstall. The attack also pushed malicious commits into repositories. JFrog noted odd timestamp manipulation, with commit authors shown as "claude" and timestamps that appear years old, apparently to make investigation harder.
The researchers also described a GitHub Actions-based exfiltration path that bundles stolen secrets into a file and uploads it as a build artifact. In the analyzed attack, that delivery method was not actually used. They also found the operator had hardcoded the recovery phrase for their own wallet, apparently to keep the malware from stealing it during testing.
Ox Security says the attack was caught early before it could spread to more popular npm packages. The recommended response is to move to fixed versions, rotate exposed keys, and enable 2FA on all accounts.
Key points
- JFrog says IronWorm infected 36 npm packages in a supply-chain attack.
- The malware targets environment variables and credential files, including cloud and npm secrets.
- It is written in Rust and hides behind an eBPF kernel rootkit while communicating over Tor.
- Stolen publishing credentials can let the malware publish trojanized package versions and spread further.
- Ox Security says the attack was caught early and recommends fixed releases, key rotation, and 2FA.
The article says the attack was detected very early and stopped before it reached more popular npm packages. If developers follow the guidance, fixed releases, key rotation, and 2FA can reduce the chance of further spread.
If stolen publishing credentials are reused, the malware can keep spreading through trusted package workflows. That could expose more developer machines, CI systems, and secrets stored in environment variables and credential files.
