# New IronWorm Supply-Chain Attack Compromises 36 npm Packages, Targets Developer Credentials


A sophisticated supply-chain attack has infected 36 packages on the Node Package Manager (npm) registry with a stealthy Rust-based malware called IronWorm, demonstrating the growing technical complexity of attacks targeting JavaScript development ecosystems. The malware self-propagates through stolen credentials, potentially compromising thousands of downstream developers and CI/CD environments.


## The Threat


Security researchers at JFrog discovered IronWorm embedded in packages published via the compromised account 'asteroiddao' earlier in June 2026. The malware is engineered to extract sensitive credentials from infected systems, including:


  • 86 environment variables commonly used to store API keys and authentication tokens
  • 20 credential files, including configurations for:

    • - OpenAI and Anthropic API keys

    - AWS credentials

    - npm authentication tokens

    - SSH keys

    - Vault configuration files

    - Exodus cryptocurrency wallet files


    Once activated, IronWorm exfiltrates stolen credentials and uses them to publish trojanized package versions under the victim's credentials, creating a self-propagating infection chain that spreads to additional developers and CI systems downstream.


    ## Technical Architecture


    IronWorm represents a significant escalation in supply-chain attack sophistication:


    ### Malware Composition

  • Language: Rust binary compiled as an ELF executable
  • Trigger mechanism: Executed via npm's 'preinstall' hook, running automatically during package installation
  • Kernel component: Leverages an eBPF (extended Berkeley Packet Filter) kernel rootkit for privilege escalation and stealth
  • Command & control: Routes communications through the Tor network to avoid attribution and detection

    • ### Propagation Method

    The malware exploits npm's Trusted Publishing workflow, a feature designed to allow automated package publishing from CI/CD systems. By stealing authentication tokens and SSH keys, the attacker gains the ability to publish legitimate-looking package updates, bypassing standard security review processes.


    ### Exfiltration Technique

    Researchers discovered a particularly sophisticated data exfiltration method that abuses GitHub Actions:


    1. The malware serializes stolen credentials into a single payload

    2. Writes the data to a file with an innocuous name (mimicking linter or formatter output)

    3. Uploads the file as a GitHub Actions build artifact

    4. The attacker retrieves the artifact without requiring a traditional command-and-control infrastructure


    This approach significantly reduces the forensic fingerprint compared to direct network communications, potentially allowing data theft to persist undetected for extended periods.


    ## Background and Context


    ### Connection to Prior Attacks


    JFrog researchers identified striking similarities between IronWorm and Shai Hulud, a separate npm supply-chain attack that compromised over 600 packages. Both attacks share identical commit author names, raising the possibility that IronWorm represents an evolution of the Shai Hulud malware—potentially a refined version deployed by the same threat actor or derived from TeamPCP's source code.


    | Characteristic | IronWorm | Shai Hulud |

    |---|---|---|

    | Malware Language | Rust | JavaScript |

    | Packages Affected | 36 | 600+ |

    | Credential Targets | 86 env vars, 20 files | Web credentials |

    | Propagation | Self-spreading via stolen credentials | Direct package poisoning |

    | Detection Status | Caught early | Widespread before detection |


    ### Concurrent Attack Activity


    Security researchers at Endor Labs and StepSecurity identified a related but distinct attack occurring simultaneously, involving a JavaScript-based malware named binding.gyp that performs registry poisoning and GitHub Actions infection. The temporal overlap and similar techniques suggest either coordinated activity or copycat attacks exploiting the same npm ecosystem vulnerabilities.


    ## Implications for Development Organizations


    ### Immediate Risk Surface


    Any developer or organization using affected npm packages faces potential credential compromise. The breadth of targeted secrets creates a cascading risk:


  • Developer machines: SSH keys, local API credentials, cryptocurrency wallets
  • CI/CD pipelines: AWS credentials, npm tokens, deployment keys
  • Cloud environments: API keys for OpenAI, Anthropic, and other cloud services
  • Access control: Stolen credentials can be used to lateral-move through organizational infrastructure

    • ### Supply-Chain Amplification


    Unlike direct malware distribution, supply-chain attacks amplify through the dependency graph. A single compromised package can infect:

  • Downstream packages that depend on the poisoned package
  • Development teams that use those downstream packages
  • Production systems deploying applications built from the dependency chain

    • This creates an expanding circle of potential victims that extends far beyond the initial 36 packages.


    ### Operational Security Failures Reveal Sophistication


    An unusual discovery in the malware analysis suggests the threat actor is highly skilled but operating under time pressure: the malware contained the attacker's own cryptocurrency wallet recovery phrase, hardcoded into the binary. Researchers believe this was an operational security failure—the attacker likely disabled credential theft during testing to avoid stealing their own wallet, then forgot to remove the hardcoded phrase before deployment.


    Additionally, the attack used backdated Git commits (some purporting to be from 13 years ago) paired with recent push timestamps, a technique designed to evade temporal-based forensic investigation.


    ## Detection and Response


    ### Early Detection Success


    Application security company Ox Security detected the IronWorm attack early in its lifecycle and coordinated with npm to remove malicious packages before the attack could reach more widely-used dependencies. This represents a rare successful early-stage supply-chain attack interdiction.


    ### Affected Packages


    JFrog published a complete list of 36 impacted package names and vulnerable versions. Organizations should:


    1. Audit dependencies: Check if any affected packages are in your dependency tree (directly or transitively)

    2. Review activity logs: Check for installation or execution of suspicious package versions during the attack window

    3. Credential rotation: Assume any credentials stored in environment variables or files may be compromised


    ## Recommendations for Defenders


    ### Immediate Actions


  • Upgrade packages: Update to patched versions of affected packages
  • Rotate credentials: Change API keys, AWS credentials, npm tokens, and SSH keys that may have been exposed
  • Enable two-factor authentication (2FA): Require 2FA on all accounts with publishing rights, including npm, GitHub, and cloud services
  • Review access logs: Check for unauthorized publishing activity in package registries and git repositories

    • ### Medium-Term Hardening


  • Audit GitHub Actions workflows: Review for suspicious artifact uploads or environment variable access patterns
  • Implement SBOM tracking: Maintain Software Bill of Materials for all production applications to rapidly assess exposure
  • Code signing: Require cryptographic signatures on all package publishing, making unsigned packages rejected by default
  • Secrets management: Migrate from environment variables to centralized secrets management systems (e.g., HashiCorp Vault, AWS Secrets Manager)

    • ### Strategic Considerations


  • Supply-chain security tools: Deploy continuous monitoring of package registry activity
  • Dependency auditing: Use tools like npm audit, Snyk, or Dependabot to track vulnerable and suspicious packages
  • Isolation policies: Restrict network access from CI/CD environments to reduce lateral movement if credentials are compromised

    • ---


    ## HackWire Analysis


    The IronWorm attack represents a deliberate inflection point in the sophistication arms race affecting open-source ecosystems. What distinguishes this threat from earlier supply-chain attacks is not just technical prowess—it's operational discipline paired with clear operational security failures that reveal the attacker's mindset.


    The Rust-based malware with eBPF rootkit capabilities suggests state-level or well-funded private threat actor involvement. These tools are expensive to develop and maintain. Yet the hardcoded cryptocurrency wallet recovery phrase is a smoking gun pointing to human error under time pressure—the kind of mistake advanced operators make when operating at scale or racing against detection.


    More concerning is the evidence of tactical diversification: the concurrent binding.gyp attack on the same registry using different techniques suggests threat actors are treating npm as contested infrastructure, experimenting with multiple exploitation vectors simultaneously. This is not opportunistic malware—it's persistent presence.


    For the broader developer community, the most overlooked risk is GitHub Actions abuse. That exfiltration technique (serializing secrets into artifact files) is particularly insidious because organizations typically don't audit GitHub Actions artifacts with the same rigor they apply to network traffic. The malware effectively weaponized a feature designed for legitimate CI/CD workflows.


    Organizations should treat this not as an isolated supply-chain incident but as a signal that the attack surface on npm has become genuinely contested infrastructure. The question is no longer whether your dependencies will be targeted, but when, and whether your detection and response posture can match the pace of attackers now operating with purpose-built tooling and operational sophistication.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Breaches](https://www.hackwire.news/category/breaches) and [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)