### IronWorm Infostealer Hits npm Packages A new, sophisticated supply-chain attack has been detected, compromising 36 packages on the **Node Package Manager (npm)** index. The malware, identified as **IronWorm**, is a **Rust**-based infostealer designed to pilfer critical developer credentials and sensitive configuration files. ### Deep Dive into IronWorm's Capabilities According to researchers at supply-chain and DevOps company **JFrog**, **IronWorm** is particularly insidious. It targets an extensive list of 86 environment variables and 20 specific credential files. These include highly sensitive data such as **OpenAI**, **AWS**, **Anthropic**, and **npm** credentials, vault configuration files, **SSH** keys, and **Exodus** cryptocurrency wallet files. The malware employs advanced stealth techniques, including hiding behind an **eBPF kernel rootkit** and communicating with its operators over the **Tor network**. ### Self-Propagation and Supply Chain Risk A key characteristic of **IronWorm** is its self-propagating nature. Once it compromises a developer or CI environment, it leverages stolen credentials—including those associated with **npm**'s Trusted Publishing workflow—to publish trojanized versions of packages owned by the victim. This enables the malware to spread autonomously, infecting additional developers and CI systems further down the supply chain. This behavior mirrors that of the previously identified **Shai Hulud** malware, with researchers noting identical commit names in both campaigns, suggesting a possible evolution or shared origin. ### Attack Vector and Evasion Tactics The latest **IronWorm** campaign reportedly originated from a compromised account named ‘asteroiddao’. Malicious commits, pushing a **Rust ELF** binary executed via a ‘preinstall’ script, were observed. To evade detection and forensic analysis, the attackers manipulated commit timestamps, making them appear several years old, in some cases up to 13 years prior to their actual push date. ### Sophisticated Exfiltration Mechanism (Unused) **JFrog**'s analysis also uncovered a sophisticated, albeit unused in this specific attack, exfiltration mechanism leveraging **GitHub Actions**. This method involves serializing stolen secrets into a single value, writing it to a harmless-looking file (mimicking lint or formatting output), and then uploading it as a build artifact. This technique would allow threat actors to retrieve secrets without the need for an external command-and-control (C2) server, making detection even more challenging. Intriguingly, researchers also found that the operator had hardcoded their own cryptocurrency wallet recovery phrase, likely for testing purposes to prevent self-infestation during development. ### Early Detection and Mitigation Fortunately, the **IronWorm** attack was detected early by application security company **Ox Security**, preventing its spread to more widely used **npm** packages. **Ox Security** has provided a list of all impacted package names and versions. They strongly advise developers to upgrade to fixed releases, promptly rotate all their keys, and enable two-factor authentication (**2FA**) for all accounts to bolster their defenses. ### Parallel Threats Emerge Concurrently, security firms **Endor Labs** and **StepSecurity** have identified a distinct but similar attack unfolding. This campaign involves a **JavaScript**-based malware named **binding.gyp**, which performs registry poisoning and **GitHub Actions** infection, highlighting a broader trend of sophisticated supply chain attacks targeting developer ecosystems.