Ethical Hacking News
A new malware attack has been discovered on the Node Package Manager (npm) index, infecting 36 packages with infostealer malware called IronWorm. The malware targets environment variables and credential files, using stolen credentials for publishing on npm. This is the latest supply-chain attack to target the npm index, highlighting the need for vigilance in monitoring and addressing vulnerabilities before they can spread further.
The Node Package Manager (npm) index has been targeted by a new supply-chain attack attributed to IronWorm malware.The affected packages have been compromised with infostealer malware, which targets sensitive information such as credentials and environment variables.The malware self-propagates using stolen credentials for publishing on npm, potentially leading to further attacks.A custom-built implant from an operation with its own infrastructure is suspected to be the origin of IronWorm.The attack has been detected early, and measures are recommended to prevent future incidents.
The cybersecurity landscape has witnessed a significant escalation in recent days, as a new supply-chain attack has been identified and attributed to the Node Package Manager (npm) index. The affected packages have been compromised by an infostealer malware known as IronWorm, which is believed to be written in Rust and hides behind an eBPF kernel rootkit.
According to researchers at JFrog, a supply-chain and devops company, IronWorm has already infected 36 packages on the npm index. The malware targets specific environment variables (key-value pairs) and credential files that may contain sensitive information such as OpenAI, AWS, Anthropic, and npm credentials, vault configuration files, SSH keys, and Exodus cryptocurrency wallet files.
The Rust-based malware self-propagates by using stolen credentials for publishing on npm; this includes secrets associated with npm's Trusted Publishing workflow. This behavior is conceptually similar to Shai Hulud, which had its code published on GitHub recently. Although JFrog researchers did not find a clear connection between IronWorm and Shai Hulud, they observed the same commit names in both supply-chain attacks.
This opens the possibility that the new malware is an evolution of TeamPCP’s payload, since IronWorm appears to be "a custom, carefully built implant from an operation with its own infrastructure." The latest attack started from a compromised account named ‘asteroiddao,’ which published package versions containing the Rust ELF binary executed via ‘preinstall,’ pushing malicious commits into repositories.
The commit author appears as “claude,” and the timestamps point to several years ago, up to 13 years in some cases, even though they were pushed in the past few days. This is likely to evade investigation. One notable element in JFrog’s findings is a mechanism that relies on GitHub Actions to deliver the stolen secrets.
The malware serializes the secrets into a single value and then "writes it to a file with a harmless-looking name, as if it were lint or formatting output." The last step of the process is uploading the file as a build artifact, which can be downloaded by anyone with access. This way, the threat actor can avoid the need for an external command-and-control (C2) altogether.
However, the researchers note that this delivery mechanism has not been used in the analyzed IronWorm supply-chain attack. Another peculiarity discovered is that the operator hardcoded the recovery phrase of their own cryptocurrency wallet. The researchers say that the only reason for this is that the threat actor did not want the malware to steal it during the test stage.
Application security company Ox Security says that the IronWorm attack was detected very early and stopped before it spread to more popular packages on npm. The company provides a list of all impacted package names and their versions in the report and recommends that developers upgrade to fixed releases, rotate their keys, and enable two-factor authentication (2FA) for all accounts.
At the same time, Endor Labs and StepSecurity have spotted a very similar but distinct attack involving a JavaScript-based malware named binding.gyp, performing registry poisoning and GitHub Actions infection, unfolding during the same timeframe. The situation highlights the need for vigilance in monitoring and addressing supply-chain attacks before they can spread further.
In conclusion, the recent npm supply-chain attack attributed to IronWorm malware serves as a stark reminder of the potential risks associated with vulnerabilities in software dependencies and the importance of maintaining strict security controls throughout the software development life cycle.
Related Information:
https://www.ethicalhackingnews.com/articles/New-IronWorm-Malware-Attacks-npm-Supply-Chain-Infects-36-Packages-ehn.shtml
https://www.bleepingcomputer.com/news/security/new-ironworm-malware-hits-36-packages-in-npm-supply-chain-attack/
Published: Thu Jun 4 12:03:37 2026 by llama3.2 3B Q4_K_M
