cyber.hendryadrian.com
Security News · thehackernews.com

IronWorm and New Miasma Variant Target npm in Supply-Chain Attacks

· Original article ↗

Summary

Researchers report npm campaigns distributing IronWorm and a new Miasma variant across dozens of packages. The malware steals developer and CI/CD secrets and spreads through package publishing and GitHub; attribution for the latest Miasma activity remains unclear.

Key points

  • JFrog traced IronWorm distribution to a compromised npm account, asteroiddao, which published trojanized packages containing a Rust payload executed through a preinstall hook.
  • IronWorm targets developer secrets, spreads through GitHub commits and npm publishing, and uses an eBPF rootkit to hide processes; its hiding techniques fail when kernel lockdown is enabled.
  • Endor Labs and StepSecurity reported that a Miasma variant affected 57 npm packages across more than 286 malicious versions.
  • The campaign used a 157-byte binding.gyp file, dubbed “Phantom Gyp,” to trigger code execution during npm install and bypass many checks focused on install scripts.
  • Miasma downloads the Bun runtime to harvest credentials across developer and CI/CD environments; it can also plant files that execute when a project is opened in an AI-assisted IDE.
  • Researchers reported stolen data being sent to GitHub accounts or public repositories. The latest attacks’ attribution remains unclear, and Red Hat said a compromised GitHub account was a likely cause of its incident.
  • Developers who installed an affected version were advised to rotate credentials, disable install scripts and native rebuilds by default, and pin packages with integrity hashes.

Article Details

Event Type
Software supply-chain attacks against npm packages distributing the IronWorm stealer and a new Miasma worm variant.
Impact
The attacks compromised npm packages and developer or CI/CD environments to steal credentials and other secrets, modify repositories, and republish poisoned packages for further propagation. Miasma was reported in 57 packages across more than 286 malicious versions; IronWorm also used stolen credentials to push malicious commits across repositories.

MITRE ATT&CK

T1014 · RootkitIronWorm used an eBPF payload described as a kernel-level rootkit to hide processes.T1059.007 · JavaScriptThe Miasma variant used Bun to load and execute a JavaScript credential harvester.T1105 · Ingress Tool TransferThe attack chain dynamically downloaded the Bun runtime for the target platform.T1195.002 · Compromise Software Supply ChainAttackers compromised npm packages and repositories to distribute malware through the software supply chain.T1548.003 · Sudo and Sudo CachingIn CI/CD environments, the Miasma campaign reportedly escalated privileges using passwordless sudo.T1552.001 · Credentials In FilesThe malware harvested credentials and secrets from files and developer or CI/CD environments.T1567.001 · Exfiltration to Code RepositoryStolen data was exfiltrated to public GitHub repositories.

People

Moshe Siman Tov BustanSecurity researcher who, with Nir Zadok, described the use of GitHub commits containing the string “firedalazer” to retrieve another payload and the adaptive use of GitHub as C2.Nir ZadokSecurity researcher who, with Moshe Siman Tov Bustan, described the use of GitHub commits containing the string “firedalazer” to retrieve another payload and the adaptive use of GitHub as C2.Sai LikhithStepSecurity researcher who described the Miasma campaign's use of a 157-byte binding.gyp file to trigger code execution during npm install.

Threat Actors

TeamPCPThe Miasma payload is assessed to be a derivative of the Shai-Hulud worm used by TeamPCP in recent campaigns. The article says attribution for the latest attacks remains unclear and does not confirm TeamPCP's involvement in them.

Malware

IronWormMultiple supply chain attacks have compromised dozens of npm packages to spread IronWorm and a new Miasma worm variant, both designed to steal secrets and self-propagate through developer and CI/CD environments.MiasmaMultiple supply chain attacks have compromised dozens of npm packages to spread IronWorm and a new Miasma worm variant, both designed to steal secrets and self-propagate through developer and CI/CD environments.Shai-HuludThe stealer also uses the stolen credentials as a propagation mechanism, drawing similarities to the infamous Shai-Hulud worm.

Vendors

Red HatIn an update shared this week, Red Hat revealed that the root cause behind the Miasma supply chain incident was likely a compromised GitHub account that was used to push unauthorized commits to repositories in the

Products

BunThe attack chain abuses GitHub Actions, Bun runtime, and public GitHub repos to exfiltrate data and republish poisoned packages.GitHubThe campaigns abuse npm lifecycle hooks, GitHub commits, and trusted publishing to infect repositories, exfiltrate credentials, and keep republishing poisoned packages across the ecosystem.GitHub ActionsThe attack chain abuses GitHub Actions, Bun runtime, and public GitHub repos to exfiltrate data and republish poisoned packages.npmMultiple supply chain attacks have compromised dozens of npm packages to spread IronWorm and a new Miasma worm variant, both designed to steal secrets and self-propagate through developer and CI/CD environments.

Related Articles