Fact-check findings

The reviewer could not reconcile the claim with the evidence it cited. This is a lead, not a ruling that the claim is false.

1. #3[disputed][awaiting moderator]in section: Technical Architecture

   “Cursor editor auth tokens (~~/Cursor/auth.json)”

   reviewerCursor auth token pathThe page has a doubled tilde typo. JFrog gives ~/Cursor/auth.json.
   Proposed correction (not yet applied)

   Cursor editor auth tokens (~/Cursor/auth.json)
   citedresearch.jfrog.com/post/iron-worm-shai-h…-rustier-cousin/
2. #10[disputed][awaiting moderator]in the timeline

   “IronWorm publicly disclosed following SlowMist alert; malicious npm package versions detected under the 'asteroiddao' account targeting the Arweave/WeaveDB ecosystem.”

   reviewerIronWorm publicly disclosed 2026-06-04 following a SlowMist alertThree of the four sources read attribute the disclosure to JFrog and none mention SlowMist. The cited CryptoTimes page could not be fetched, so the correction is not fully certain.
   Proposed correction (not yet applied)

   IronWorm publicly disclosed following JFrog Security Research analysis; malicious npm package versions detected under the 'asteroiddao' account targeting the Arweave/WeaveDB ecosystem.
   citedwww.cryptotimes.io/2026/06/04/ironworm-m…ed-npm-packages/
3. #11[disputed][awaiting moderator]in the timeline

   “2026-06-05”

   reviewerJFrog published its full analysis on 2026-06-05The JFrog post is dated 3 June, and BleepingComputer cited it on 4 June, so a 5 June publication is not possible. The same error affects the summary text 'approximately June 4–5, 2026' in sections[0].
   Proposed correction (not yet applied)

   2026-06-03
   citedresearch.jfrog.com/post/iron-worm-shai-h…-rustier-cousin/
4. #12[disputed][awaiting moderator]in section: Campaign Overview

   “IronWorm was publicly disclosed on approximately June 4–5, 2026”

   reviewerIronWorm was disclosed approximately June 4-5, 2026Same underlying error as the JFrog publication date in the timeline. The original is hedged ('approximately'), so this is a minor discrepancy.
   Proposed correction (not yet applied)

   IronWorm was publicly disclosed on approximately June 3–4, 2026
   citedresearch.jfrog.com/post/iron-worm-shai-h…-rustier-cousin/

No source the reviewer could reach confirms or contradicts the claim.

1. #8[unverifiable][awaiting moderator]in section: Operator Identification: Hardcoded Wallet Recovery Phrase

   “A 'TrapDoor' campaign was also reported in May 2026 as part of the broader threat environment targeting npm and developer tooling.”

   reviewerTrapDoor campaign reported in May 2026Not found in the cited Hacker News piece or in the other sources read.
   citedthehackernews.com/2026/06/ironworm-and-n…orm-variant.html
2. #15[unverifiable][awaiting moderator]in the timeline

   “57 backdated malicious commits removed from the nine affected GitHub organizations, though some remain visible afterward.”

   reviewer57 backdated commits were removed on 2026-06-05The removal itself is supported, but the 2026-06-05 date and the claim that all 57 were removed are not stated. Sources say most were removed.
   citedresearch.jfrog.com/post/iron-worm-shai-h…-rustier-cousin/

The cited evidence supports part of the claim but not all of it.

1. #2[partially supported][awaiting moderator]in the summary

   “making it one of the most technically sophisticated crypto-targeting supply chain attacks publicly documented to date.”

   reviewerIronWorm is one of the most technically sophisticated crypto-targeting supply chain attacks publicly documented to dateThe features are real, but the comparative superlative is the page's own editorial judgment. No source ranks it this way. The campaign was also caught early and the wallet had no activity.
2. #7[partially supported][awaiting moderator]in section: Operator Identification: Hardcoded Wallet Recovery Phrase

   “JFrog's analysis positions IronWorm as an evolution of the 'Shai-Hulud' malware family, sharing architectural similarities while introducing more sophisticated Rust-based implementation and eBPF rootkit capabilities.”

   reviewerIronWorm is an evolution of the Shai-Hulud familyThe relationship is described as uncertain in the sources. The page states it as settled. The correction is only a suggestion and is not fully verified against the JFrog page wording.
   citedresearch.jfrog.com/post/iron-worm-shai-h…-rustier-cousin/
3. #9[partially supported][awaiting moderator]in section: Affected npm Packages and Ecosystem

   “which showed zero transaction history at the time of JFrog's analysis, consistent with the campaign still being in an early or testing phase at the time of discovery.”

   reviewerOperator wallet showed zero transaction historyThe address matches. The 'zero history' wording is slightly stronger than JFrog's 'near-empty'. The inference about an early or testing phase is the page's own.
   citedresearch.jfrog.com/post/iron-worm-shai-h…-rustier-cousin/
4. #13[partially supported][awaiting moderator]in the timeline

   “BleepingComputer and The Hacker News publish coverage; The Hacker News also reports the concurrent Miasma worm variant in the same npm attack wave.”

   reviewerBleepingComputer and The Hacker News published coverage on 2026-06-05The Hacker News is dated 5 June. BleepingComputer is dated 4 June, so the combined entry is dated wrongly for it.
   citedthehackernews.com/2026/06/ironworm-and-n…orm-variant.html
5. #14[partially supported][awaiting moderator]in the timeline

   “Malicious npm package versions (36–37 packages) marked as deprecated within approximately one day of publication.”

   reviewerMalicious versions deprecated within about a day, dated 2026-06-04The one-day interval is supported. The 2026-06-04 date is not stated in any source read, and the attack start date is unclear. The page's elsewhere phrasing 'of public disclosure' differs from 'of the attack beginning'.
   citedwww.cryptopolitan.com/attackers-arweaves…edb-npm-malware/

The cited evidence supports the claim as written.

1. #1[confirmed][no action needed]in the summary

   “IronWorm is a Rust-based self-propagating malware campaign that compromised 36–37 npm packages in early June 2026 by exploiting a hijacked npm account ('asteroiddao') linked to the Arweave/WeaveDB ecosystem.”

   reviewerIronWorm compromised 36-37 npm packages via the hijacked asteroiddao accountCount range matches JFrog (37) and BleepingComputer (36). The Hacker News cites 'over 50', which the page does not mention.
   citedresearch.jfrog.com/post/iron-worm-shai-h…-rustier-cousin/www.bleepingcomputer.com/news/security/n…ly-chain-attack/
2. #4[confirmed][no action needed]in section: eBPF Kernel Rootkit

   “According to JFrog's analysis, systems with kernel lockdown mode enabled experience degraded rootkit stealth, as certain BPF operations are restricted in hardened configurations.”

   reviewerRootkit stealth degrades under kernel lockdown, and ptrace attempts get SIGKILLConsistent with JFrog.
   citedresearch.jfrog.com/post/iron-worm-shai-h…-rustier-cousin/
3. #5[confirmed][no action needed]in section: Technical Architecture

   “forwarding captured data to localhost:8738.”

   reviewerExodus module forwards captured data to localhost:8738Port matches JFrog.
   citedresearch.jfrog.com/post/iron-worm-shai-h…-rustier-cousin/
4. #6[confirmed][no action needed]in section: Self-Replication via npm Trusted Publishing and GitHub Actions

   “JFrog identified 57 backdated malicious commits across nine GitHub organizations: asteroid-dao, ocrybit, alisista, warashibe, kakedashi-hacker, weavedb, ArweaveOasis, arthursimao, and mlebjerg.”

   reviewer57 backdated commits across nine named organizations with spoofed identitiesMatches JFrog. The page's list of spoofed identities omits renovate, which is minor.
   citedresearch.jfrog.com/post/iron-worm-shai-h…-rustier-cousin/
5. #16[confirmed][no action needed]in the timeline

   “Separate node-ipc maintainer account compromise reported, part of the broader threat landscape targeting npm maintainers.”

   reviewernode-ipc maintainer account compromise reported on 2026-05-14Supported by the cited article.
   citedwww.cryptopolitan.com/attackers-arweaves…edb-npm-malware/