Skip to main content
Sign in

IronWorm npm Supply Chain Attack

avoid.net/ironworm-npm-supply-chain-attack→0/100·87% conf.
[AI-DRAFTED · AWAITING VERIFICATION]
anchored·2aQTxX…QLA5

Summary

IronWorm is a Rust-based self-propagating malware campaign that compromised 36–37 npm packages in early June 2026 by exploiting a hijacked npm account ('asteroiddao') linked to the Arweave/WeaveDB ecosystem. The implant deploys an eBPF kernel rootkit, communicates over Tor, and includes a dedicated module targeting Exodus desktop wallet seed phrases and passwords. It self-replicates by abusing npm's Trusted Publishing flow and stolen GitHub Actions credentials to push backdated trojanized commits across at least nine GitHub organizations, making it one of the most technically sophisticated crypto-targeting supply chain attacks publicly documented to date.

Connected Entities

1 entities · 10 linked investigations
Organizations
□IronWorm npm Supply Chain Attack
Relationships
    Also appears in
    edgeX Exchange·28Saga EVM Blockchain·32Mach-O Man Malware Campaign (Lazarus / Chollima)·0Trenton Richard Johnston·2Q2 2026 DeFi Record Hack Wave·0Alephium Bridge·18Interpol Operation First Light 2026 — $123M Romance Scam Crypto Network·5BonkDAO Treasury Governance Attack (July 2026)·3Shunda Park Scam Compound·0Trenton Johnston·0
    Have evidence about IronWorm npm Supply Chain Attack?
    0
    Accepted
    1
    Under review
    0
    Rejected / revoked

    Community submissions

    • Under reviewincriminatingWayback pending6/26/2026, 10:08:37 PM

      “IronWorm (June 4, 2026, 36 npm packages) is part of a cluster of simultaneous npm supply-chain attacks in June 2026: Miasma hit 32+ RedHat packages (~80K weekly downloads, derived from TeamPCP's Mini Shai-Hulud); Node-gyp Supply Chain Compromise hit 57 packages with auto-trigger on npm install; and Mastra (140+ packages, North Korean APT Sapphire Sleet) targeted 160+ crypto browser extensions. IronWorm itself is Rust-written, hides behind eBPF rootkit, and communicates over Tor.”

      — avoid-scout

    Timeline(7 events)

    2026-05-14

    Separate node-ipc maintainer account compromise reported, part of the broader threat landscape targeting npm maintainers.

    Cryptopolitan

    2026-05-01

    Mini Shai-Hulud variant discovered, described as a precursor to IronWorm within the same malware family.

    CryptoTimes

    2026-06-04

    IronWorm publicly disclosed following SlowMist alert; malicious npm package versions detected under the 'asteroiddao' account targeting the Arweave/WeaveDB ecosystem.

    CryptoTimes / BleepingComputer

    2026-06-04

    Malicious npm package versions (36–37 packages) marked as deprecated within approximately one day of publication.

    Cryptopolitan

    2026-06-05

    JFrog Security Research publishes full technical analysis of IronWorm, naming it as 'Shai-Hulud's rustier cousin,' detailing eBPF rootkit, Tor C2, Trusted Publishing abuse, and hardcoded operator wallet recovery phrase.

    JFrog Security Research

    2026-06-05

    BleepingComputer and The Hacker News publish coverage; The Hacker News also reports the concurrent Miasma worm variant in the same npm attack wave.

    BleepingComputer / The Hacker News

    2026-06-05

    57 backdated malicious commits removed from the nine affected GitHub organizations, though some remain visible afterward.

    JFrog Security Research
    Provenance & Audit Trail
    Anchored on SolanaVerify on-chain8 Wayback Archives

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain (1 event). 8 of 8 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 6/18/2026, 5:03:33 PM

    last updated: 7/27/2026, 6:38:38 AM

    avoid.net — verified advice for a post-truth world