Security researchers report a new npm supply-chain campaign involving a Rust-written malware family called IronWorm. Multiple outlets describe that the attacker compromises developer or CI environments and then uses stolen credentials to publish trojanized packages under accounts controlled by the victim. According to reporting that cites JFrog research, IronWorm is distributed through malicious and “poisoned” versions of legitimate npm packages. The number of affected packages is reported as 36 in some coverage, while other reporting indicates the campaign involves more than dozens of packages.
IronWorm is described as an information stealer that targets environment variables and credential files on infected systems, including secrets that may relate to services such as OpenAI and AWS, as well as npm credentials. Researchers also say it hides its activity behind an eBPF-based kernel rootkit and uses Tor for communications with its operator. After initial compromise, it can publish altered versions of packages owned by the victim, which then infect additional developers and CI systems.
The campaign is reported to be similar in operation to other npm supply-chain malware and is discussed alongside related observations, including reuse of commit names seen in at least one other recent campaign. Researchers recommend updating affected packages and rotating credentials.
