A newly uncovered supply chain attack dubbed “IronWorm” is leveraging malicious npm packages to compromise developer environments, steal sensitive credentials, and propagate itself across repositories in a worm-like fashion.
The campaign, identified in the wild, targets software developers with a particular focus on crypto and Web3 ecosystems, where exposed secrets can yield immediate financial value.
Researchers noticed suspicious behavior when multiple packages were republished within a short time window, each embedding a native binary executed through a preinstall hook.
One such package, weavedb-sdk version 0.45.3, contained a hidden Linux ELF binary placed in a tools directory, executed automatically during installation without user interaction.
Initial analysis revealed the binary was packed using a modified UPX stub designed to evade standard unpacking. By restoring the altered UPX signature, researchers successfully unpacked the sample, exposing a large Rust-based payload.
The use of Rust significantly increased reverse engineering complexity due to its extensive runtime and compiled abstractions.
Additionally, all meaningful strings were encrypted with unique keys per call site, requiring individual decryption efforts to uncover operational details.
Once decoded, the malware’s functionality became clear. IronWorm is a full-scale infostealer and propagation engine that targets developer secrets across cloud platforms, CI/CD pipelines, AI services, and local credential files.
It scans over 80 environment variables and numerous credential file paths, including modern AI tooling configurations alongside traditional cloud credentials.
JFrog said in a report shared with GBhackers, the attack was first observed in npm packages published by the account “asteroiddao,” linked to the asteroid-dao GitHub organization within the Arweave ecosystem.
The malware also includes specialized modules, such as one targeting Exodus cryptocurrency wallets by injecting malicious JavaScript to capture passwords and recovery phrases.
A key feature of IronWorm is its self-propagation mechanism. Stolen GitHub credentials are used to inject malicious commits into accessible repositories.
These commits either introduce build-time execution hooks or replace existing GitHub Actions workflows with secret-harvesting pipelines.
IronWorm npm Attack
In one observed technique, repository secrets are serialized using GitHub Actions expressions and exfiltrated as build artifacts, avoiding the need for external command-and-control communication.
Some malicious commits remained visible afterward, and the compromised account had been highly active that month, with around 4,500 contributions to private projects.
The attackers employed advanced evasion tactics to blend malicious activity into legitimate workflows. Commits were backdated to appear years old, leveraging Git’s flexible timestamping.
Author identities such as “claude” or automation bots like dependabot were spoofed to reduce suspicion. In total, researchers identified 57 malicious commits across nine organizations, although the true scope may be larger due to activity in private repositories.
The malware also carried an embedded ELF file: a BPF object compiled with clang 22.1.5. Its original build path was still present in the binary, but the real gift was the metadata left behind by the compiler.
IronWorm also abuses npm’s Trusted Publishing mechanism. When executed in CI environments, it requests an OIDC token and exchanges it for a short-lived npm publishing token, allowing it to release trojanized package versions without directly handling credentials.
At the system level, the malware deploys an eBPF-based rootkit to conceal its presence. The rootkit hides processes, network connections, and interferes with debugging attempts by manipulating kernel-level telemetry. However, on hardened systems with kernel lockdown enabled, some of these stealth capabilities are reduced.
For command and control, IronWorm establishes communication over the Tor network, using embedded Tor clients to anonymize traffic.
It supports commands for data exfiltration, payload delivery, and remote shell access. Researchers also identified fallback mechanisms using public file-sharing services tunneled through Tor.
Despite its sophistication, the malware contains operational mistakes. Notably, a hardcoded cryptocurrency wallet recovery phrase was embedded in the binary and excluded from exfiltration routines, likely to protect the operator’s own assets. This oversight provides a potential attribution lead.
Most malicious npm packages and GitHub commits were removed shortly after discovery, but remnants remain, indicating incomplete cleanup.
The campaign highlights a growing trend of highly automated, self-replicating supply chain attacks that weaponize developer trust and tooling ecosystems.
Indicators of compromise
Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
