v1 → v2
Scores
trust_score0 → 0
severity_base— → —
score_modifier-1.4 → -16.4
Sections
Campaign Overview
unchanged
Technical Architecture
unchanged
eBPF Kernel Rootkit
unchanged
Tor Command-and-Control Infrastructure
unchanged
Self-Replication via npm Trusted Publishing and GitHub Actions
unchanged
Affected npm Packages and Ecosystem
unchanged
Operator Identification: Hardcoded Wallet Recovery Phrase
unchanged
Relationship to Prior Campaigns
unchanged
Remediation and Response
unchanged
Timeline events
No timeline changes.
Accepted submissions
- removedurlincriminating
{"urls":["https://www.bleepingcomputer.com/news/security/new-ironworm-malware-hits-36-packages-in-npm-supply-chain-attack/","https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages","https://snyk.io/blog/node-gyp-supply-chain-compromise-self-propagating-npm-worm-binding-gyp/","https://www.securityweek.com/north-korean-hackers-blamed-for-mastra-npm-supply-chain-attack/"],"summary":"IronWorm (June 4, 2026, 36 npm packages) is part of a cluster of simultaneous npm supply-chain attacks in June 2026: Miasma hit 32+ RedHat packages (~80K weekly downloads, derived from TeamPCP's Mini Shai-Hulud); Node-gyp Supply Chain Compromise hit 57 packages with auto-trigger on npm install; and Mastra (140+ packages, North Korean APT Sapphire Sleet) targeted 160+ crypto browser extensions. IronWorm itself is Rust-written, hides behind eBPF rootkit, and communicates over Tor."}Each version is bound to the decision event that created it. Verify the chain anchor for either via the audit log.
v1 hash: 8XVUkjeidX9wJJLdaWY4j4vKuW3CfcvQPHyx2Je7yYUa
v2 hash: 8352e555174dbc9632e3c878cb00db0fef2adea8c723ffb6c032063493725c40