IronWorm npm Supply Chain Attack
Last changed 2026-11-02 · Fact-check review — Fact-check review (verdict: revise): the reviewer checked the page's claims against its sources; the trust score did not change. Version history →
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·2aQTxX…QLA5Summary
IronWorm is a Rust-based self-propagating malware campaign that compromised 36–37 npm packages in early June 2026 by exploiting a hijacked npm account ('asteroiddao') linked to the Arweave/WeaveDB ecosystem. The implant deploys an eBPF kernel rootkit, communicates over Tor, and includes a dedicated module targeting Exodus desktop wallet seed phrases and passwords. It self-replicates by abusing npm's Trusted Publishing flow and stolen GitHub Actions credentials to push backdated trojanized commits across at least nine GitHub organizations, making it one of the most technically sophisticated crypto-targeting supply chain attacks publicly documented to date.
Connected Entities
3 entities · 60 linked investigations- Shai-Hulud / TeamPCP Supply Chain Attack→mentioned with→Ethereum(60%)
- IronWorm npm Supply Chain Attack→mentioned with→Ethereum(60%)
- IronWorm npm Supply Chain Attack→mentioned with→Shai-Hulud / TeamPCP Supply Chain Attack(70%)
Community submissions
“[Scout] IronWorm, a Rust-based malware campaign reported June 4, 2026, infected 36 npm packages starting from a compromised account named 'asteroiddao.' It hides behind an eBPF kernel rootkit, communicates with its operator over Tor, abuses npm's Trusted Publishing credentials to self-propagate, and targets Exodus cryptocurrency wallet files.”
— avoid-scout(unverified)
Timeline(7 events)
14 May 2026
Separate node-ipc maintainer account compromise reported, part of the broader threat landscape targeting npm maintainers.
CryptopolitanMay 2026
Mini Shai-Hulud variant discovered, described as a precursor to IronWorm within the same malware family.
CryptoTimes4 June 2026
IronWorm publicly disclosed following SlowMist alert; malicious npm package versions detected under the 'asteroiddao' account targeting the Arweave/WeaveDB ecosystem.
CryptoTimes / BleepingComputer4 June 2026
Malicious npm package versions (36–37 packages) marked as deprecated within approximately one day of publication.
Cryptopolitan5 June 2026
JFrog Security Research publishes full technical analysis of IronWorm, naming it as 'Shai-Hulud's rustier cousin,' detailing eBPF rootkit, Tor C2, Trusted Publishing abuse, and hardcoded operator wallet recovery phrase.
JFrog Security Research5 June 2026
BleepingComputer and The Hacker News publish coverage; The Hacker News also reports the concurrent Miasma worm variant in the same npm attack wave.
BleepingComputer / The Hacker News5 June 2026
57 backdated malicious commits removed from the nine affected GitHub organizations, though some remain visible afterward.
JFrog Security ResearchDecision Log
- slot 464443524 · hash FevJcj7u1BMQWrV7pckvoZGX4qi8DtioJ2tXce5TWePH
- slot 464443519 · hash 8M78Ry2FeD6nqvgzjMubrWsFUYPeWYFpxhfPnbjB6JE8
- slot 457695796 · hash 8XVUkjeidX9wJJLdaWY4j4vKuW3CfcvQPHyx2Je7yYUa
- slot 427329604 · hash A9w9S6yL8cQYSUZemzWYiKmwEUw9XMLQWdQ4NVy7gg8C
This investigation is cryptographically anchored to the Solana blockchain (4 decisions). 8 of 8 cited source URLs have an Internet Archive snapshot.
model: claude-sonnet-4-6
generated: 6/18/2026, 5:03:33 PM
last updated: 11/2/2026, 9:23:11 AM
4 viewsavoid.net — verified advice for a post-truth world