IronWorm Supply-Chain Attack Targets Developers via Malicious npm Packages
By
Varshini
Pure flour-power. Hearty enough to carry you through lunch.
Summary
A new self-replicating supply-chain attack called "IronWorm" has been discovered targeting software developers, particularly in the crypto and web3 sectors. Built in Rust and using an eBPF rootkit, the infostealer weaponizes stolen credentials to silently inject itself into victims' GitHub repositories and publish trojanized packages to the npm registry. The campaign was first detected when multiple npm packages tied to the Arweave/WeaveDB ecosystem were suspiciously republished within a tight timeframe.
Key quotes
· 4 pulledA new self-replicating supply-chain attack dubbed 'IronWorm' has been discovered in the wild.
Built in Rust and hiding behind an eBPF rootkit, this heavy infostealer targets software developers, with a specific focus on the crypto and web3 sectors.
IronWorm weaponizes stolen credentials to silently inject itself into victims' GitHub repositories and publish trojanized packages directly to the npm registry.
The campaign was first detected when multiple npm packages tied to the Arweave/WeaveDB ecosystem were suspiciously republished within a tight timeframe.
You might also wanna read
Crates.io Targeted by Phishing Attempt Following npm Supply Chain Attack
The article discusses a phishing attempt targeting crates.io, the main public repository for Rust packages, following a recent npm supply ch
fasterthanli.me·9mo ago
Glassworm Threat Actor Returns with Unicode-Based Supply Chain Attacks on GitHub, npm, and VS Code
The Glassworm threat actor has returned with a new wave of supply chain attacks using invisible Unicode characters to compromise software re
aikido.dev·2mo ago
GitLab Identifies Large-Scale npm Supply Chain Attack with Destructive Malware
GitLab's security researchers have uncovered a large-scale supply chain attack in the npm ecosystem involving a destructive malware variant
about.gitlab.com·6mo ago
Major NPM Supply Chain Attack: @ctrl/tinycolor and 40+ Packages Compromised with Self-Propagating Malware
A sophisticated supply chain attack has compromised the popular @ctrl/tinycolor NPM package (with over 2 million weekly downloads) along wit
stepsecurity.io·8mo ago
Supply Chain Attacks on Open-Source Software: Case Study of Malicious Pull Request Attempts
The article discusses recent supply chain attacks on open-source software projects like LiteLLM and axios, with a specific case study of att
casco.com·2mo ago
NPM supply chain attack compromises popular packages, posing widespread security risk
A significant supply chain attack on the NPM package ecosystem compromised several popular packages, potentially allowing malicious code to
xeiaso.net·9mo ago