IronWorm Supply Chain Malware Hits npm

Is it a bird? Is it a plane? No, it’s ANOTHER supply chain attack.

Breaking News: A new supply chain attack has hit the npm ecosystem, infecting 36 unique packages. Instead of utilizing traditional obfuscated JavaScript code, this malware hides inside binary executable files triggered by a postinstall script. Fortunately, despite the affected packages garnering a combined total of 32,177 monthly downloads, the threat was mitigated before the infection could spread to more popular packages.

Overview

IronWorm is a self-replicating, Rust-built malware campaign targeting software developers via malicious NPM packages.
The malware targets environment variables, cloud credentials, and crypto wallets.
It self replicates by stealing credentials and uploading GitHub commits that automatically publish new malicious packages.
Kudos to JFrog for detecting and reporting this campaign.

Who is affected

Anyone installing the affected versions of the malicious packages (see below)

Impact

• 36 packages were infected
• 32,177 total monthly downloads
• 148,724 total lifetime downloads

Recommended Actions

1. Rotate your keys and add 2FA to your accounts
2. Upgrade the affected packages to a fixed version

Affected Packages