IronWorm Malware Hits 36 npm Packages in Sophisticated Supply Chain Attack

What Makes IronWorm Different

Most npm supply chain attacks are written in JavaScript, making them relatively straightforward to detect through static analysis. IronWorm breaks from this pattern with three technical capabilities that distinguish it from previous attacks.

Rust-compiled binary: IronWorm is distributed as a Rust ELF binary executed through the preinstall npm lifecycle hook. This defeats most JavaScript-focused static analysis tools, increases execution performance, and complicates reverse engineering.

eBPF kernel rootkit: IronWorm deploys an eBPF-based rootkit that operates at the Linux kernel level. This allows it to hide its presence from standard process monitoring tools and security scanners that operate in user space — a technique borrowed from advanced persistent threat (APT) toolkits and rarely seen in npm supply chain attacks.

Tor network C2: Exfiltrated data is transmitted to the attacker over the Tor network, defeating IP-based detection and making infrastructure attribution extremely difficult.

Attack Chain: How It Spreads

The campaign originated from a compromised npm account named asteroiddao. This account published package versions containing the Rust ELF binary, which executed automatically via the preinstall script when any developer or CI system ran npm install.

Upon execution, IronWorm harvests 86 environment variables and 20 credential files from the compromised system. High-value targets include:

• OpenAI, AWS, and Anthropic API keys
• npm credentials and Trusted Publishing workflow secrets
• HashiCorp Vault configuration files
• SSH keys
• Exodus cryptocurrency wallet files

Self-Propagation: The Most Dangerous Feature

What separates IronWorm from a standard infostealer is its worm-like propagation mechanism. After stealing npm credentials — including Trusted Publishing secrets used by CI/CD pipelines to publish directly to npm — IronWorm uses those credentials to publish trojanized versions of packages owned by the victim developer.

This creates a cascading infection chain: one compromised developer account can infect their downstream users, whose credentials IronWorm then harvests to infect another tier of the dependency graph. The Trusted Publishing vector is particularly dangerous because it allows IronWorm to push malicious commits directly into the victim's repository, embedding the malware upstream rather than only in published package versions.

GitHub Actions as an Exfiltration Channel

JFrog's investigation uncovered a particularly evasive exfiltration method. IronWorm serializes collected secrets into a single value and writes it to a file with a name designed to look like normal lint or formatting output — the kind of file a developer or security reviewer would dismiss without scrutiny.

This file is then transmitted to the attacker via GitHub Actions, exploiting GitHub's legitimate infrastructure rather than generating suspicious outbound network connections. Because the exfiltration piggybacks on normal CI artifact uploads, it bypasses network-layer security controls that would flag unusual external connections.

Concurrent Campaign: binding.gyp

During the same window, Endor Labs and StepSecurity identified a separate but similar attack using JavaScript-based malware named binding.gyp. This campaign performed registry poisoning and GitHub Actions infection using a different mechanism.

The simultaneous timing of two distinct npm supply chain campaigns raises the possibility of a coordinated offensive against the JavaScript ecosystem rather than independent opportunistic attacks.

Defense Recommendations