IronWorm Infostealer Hits 36 npm Packages in Supply-Chain Attack
Summary
JFrog says IronWorm infected 36 npm packages, stealing developer secrets and spreading with stolen publishing credentials. Ox Security says the attack was stopped before reaching more popular packages; developers are advised to upgrade, rotate keys, and enable 2FA.
Key points
- JFrog reports that Rust-based IronWorm infected 36 npm packages and targets 86 environment variables and 20 credential files, including cloud credentials, SSH keys, and cryptocurrency wallet files.
- The malware reportedly hides behind an eBPF kernel rootkit and communicates over Tor.
- IronWorm can use stolen npm publishing credentials, including Trusted Publishing secrets, to publish trojanized packages that may infect developers and CI systems.
- JFrog traced the attack's start to the compromised npm account “asteroiddao”; malicious package versions ran a Rust binary through a preinstall script.
- A GitHub Actions artifact method for delivering stolen secrets was described by JFrog, but researchers say it was not used in the analyzed attack.
- Ox Security says the attack was detected early and stopped before spreading to more popular npm packages. Developers are advised to upgrade to fixed releases, rotate keys, and enable 2FA.
- JFrog found no clear link to Shai Hulud, though researchers observed shared commit names; a possible connection to TeamPCP remains speculative.
Article Details
- Event Type
- npm supply-chain attack involving infostealer malware
- Impact
- IronWorm infected 36 npm packages and targeted developer and CI environments, stealing environment variables and credential files that may contain cloud, npm, SSH, and cryptocurrency wallet secrets. Ox Security said the attack was detected early and stopped before spreading to more popular npm packages. JFrog described a possible GitHub Actions artifact-based secret-delivery method but said it was not used in the analyzed attack.
MITRE ATT&CK
T1078 · Valid AccountsThe attack used stolen npm publishing credentials to publish trojanized package versions.T1195.002 · Compromise Software Supply ChainIronWorm was distributed through trojanized npm package versions, compromising the software supply chain.T1552.001 · Credentials In FilesThe malware targeted credential files that could contain sensitive keys and secrets.
Threat Actors
Malware
binding.gyphave spotted a very similar but distinct attack involving a JavaScript-based malware named binding.gyp, performing registry poisoning and GitHub Actions infection, unfolding during the same time-frame.IronWormA new supply-chain attack has infected 36 npm packages with IronWorm, an infostealer that targets developer secrets, cloud credentials, SSH keys, and cryptocurrency wallet files.Shai HuludResearchers linked the initial compromise to the account named “asteroiddao” and noted similarities with Shai Hulud and TeamPCP.
Vendors
Endor LabsAt the same time, Endor Labs and StepSecurity have spotted a very similar but distinct attack involving a JavaScript-based malware named binding.gyp, performing registry poisoning and GitHub Actions infection, unfoldingJFrogJFrog says the Rust-based malware hides behind an eBPF kernel rootkit, uses Tor for communication, and self-propagates by abusing stolen npm publishing credentials.OX SecurityApplication security company Ox Security says that the IronWorm attack was detected very early and stopped before it spread to more popular packages on npm.StepSecurityAt the same time, Endor Labs and StepSecurity have spotted a very similar but distinct attack involving a JavaScript-based malware named binding.gyp, performing registry poisoning and GitHub Actions infection, unfolding
Products
GitHub ActionsOne notable element in JFrog’s findings is a mechanism that relies on GitHub Actions to deliver the stolen secrets.npmA new supply-chain attack has infected 36 npm packages with IronWorm, an infostealer that targets developer secrets, cloud credentials, SSH keys, and cryptocurrency wallet files.