A new Rust-based supply-chain malware campaign, IronWorm, actively targeting developer environments and Web3/crypto ecosystems via malicious npm packages.
Potential attacker actions include credential theft, wallet seed and password theft, GitHub repository tampering, malicious package publishing, CI/CD secret exfiltration, Tor-based command-and-control, and stealth via an eBPF rootkit.
Security teams should audit repositories for backdated commits, suspicious branches, unexpected build hooks, and commits attributed to automation-like identities such as claude, dependabot, renovate, or github-actions. Remove or deprecate affected package versions, publish clean releases, rotate all exposed secrets and tokens, review GitHub Actions artifacts, and rebuild potentially compromised developer or CI systems from clean images.
Thanks to @JFrogSecurity for the discovery…
via x.com/SlowMist_Team
Devs really said "let's build the financial system of the future" and left the door unlocked, the windows open, and a welcome mat that says
npm install trust-me. IronWorm doesn't need to be clever, it just needs you to not check your build hooks. Rotate your secrets, or don't, the malware already has them.💧 Exclusive Giveaways & Rewards USE CODE: evaders On Sign Up. If your location is restricted use a VPN.
