IronWorm: Rust-Based npm Supply-Chain Attack Uses eBPF Rootkit and Tor to Steal AI and Cloud Credentials

·

On June 4, 2026, JFrog and Ox Security disclosed IronWorm — a supply-chain attack that infected 36 npm packages with a Rust-based infostealer. The malware runs a Rust ELF binary via npm's preinstall hook, hides behind an eBPF kernel rootkit, and communicates with its operator over the Tor network, making traditional network-level detection unreliable.

IronWorm targets 86 environment variables and 20 credential files containing OpenAI, AWS, Anthropic API keys, npm tokens, vault configuration, SSH private keys, and Exodus cryptocurrency wallet files. Once it captures npm Trusted Publishing credentials, it self-propagates by publishing trojanised versions of packages owned by the victim — infecting additional developer machines and CI environments at scale.

The attack shares commit naming patterns with the earlier TeamPCP/Shai-Hulud campaign, suggesting a possible operational connection or code lineage. Ox Security reports the attack was detected early and stopped before reaching more popular package names.

◈ Table of Contents

01 The Attack: What Happened 02 Malware Capabilities 03 Credential Targets 04 Self-Propagation Mechanism 05 GitHub Actions Exfiltration 06 TeamPCP Connection 07 Detection & Response 08 Sources
📋

The Attack: What Happened

PHASE 01
01
Attack Origin and Scope
INCIDENT
The attack originated from a compromised npm account named 'asteroiddao', which published package versions embedding a Rust ELF binary executed via a preinstall hook. Commit timestamps were backdated up to 13 years to evade investigation — a deliberate timestamp manipulation tactic.
FieldDetail
Malware nameIronWorm
Packages infected36 npm packages
Origin accountasteroiddao (compromised npm account)
Commit author"claude" (with timestamps backdated up to 13 years)
Delivery mechanismRust ELF binary via npm preinstall hook
DisclosedJune 4, 2026 (JFrog and Ox Security)
ContainmentDetected early — stopped before spreading to major packages
⚙️

Malware Capabilities

PHASE 02
02
IronWorm Technical Profile
MALWARE ANALYSIS
IronWorm is described by JFrog as "a custom, carefully built implant from an operation with its own infrastructure" — not an off-the-shelf tool. Its technical stack is designed for stealth and operational security.
🦀

Rust Implementation

Written in Rust for performance and low-level system access. Compiled as a standalone ELF binary, requiring no runtime dependencies and resisting many signature-based detection approaches.

🔒

eBPF Kernel Rootkit

IronWorm hides behind an eBPF-based kernel rootkit. eBPF programs run at kernel level, allowing the malware to intercept system calls, hide network connections, and evade process-level monitoring tools.

🧅

Tor C2 Channel

Command-and-control traffic routes over the Tor network, preventing C2 IP blocking and making network-layer attribution difficult. Standard network monitoring for known C2 IPs is ineffective against this architecture.

🎯

Credential Targets

PHASE 03

IronWorm specifically targets the credentials most valuable to a developer or CI environment operator. The choice of targets indicates a threat actor focused on AI infrastructure, cloud accounts, and further supply-chain propagation.

CategorySpecific TargetsImpact
AI Provider KeysOpenAI API keys, Anthropic API keysFinancial theft (API cost billing), model abuse, data exfiltration
Cloud CredentialsAWS access keys and secrets, vault config filesFull cloud infrastructure takeover, data access
Developer Secretsnpm tokens (incl. Trusted Publishing), SSH private keysPackage hijacking for further supply-chain propagation
Crypto WalletsExodus cryptocurrency wallet filesDirect financial theft
Environment Variables86 env vars scanned per environmentBroad sweep for any secrets stored in .env files or shell config
Credential Files20 specific credential file pathsStructured search for known secret storage locations
🔄

Self-Propagation Mechanism

PHASE 04
04
How IronWorm Spreads Through the npm Ecosystem
PROPAGATION
IronWorm's self-propagation capability makes it significantly more dangerous than typical supply-chain malware. By stealing npm Trusted Publishing credentials, it can publish malicious versions of packages the victim owns — creating a cascading infection wave.
Propagation Chain
  • 1
    Developer installs an infected package — npm's preinstall hook executes the Rust ELF binary silently before the package code runs.
  • 2
    IronWorm harvests npm Trusted Publishing tokens — these tokens allow publishing new package versions to npm without requiring a password, making them especially valuable.
  • 3
    Malware publishes trojanised versions of victim-owned packages — IronWorm uses the stolen tokens to publish new versions of packages the compromised developer maintains, embedding its own payload.
  • 4
    Downstream consumers are infected — developers and CI/CD pipelines that depend on those packages pull the trojanised version on next install, restarting the cycle.

npm Trusted Publishing tokens are particularly high-value targets. Unlike traditional passwords or 2FA, these tokens can be used non-interactively to publish packages — making them ideal for automated propagation. Any developer with Trusted Publishing enabled who installed an infected package should consider their publishing tokens compromised and rotate immediately.

☁️

GitHub Actions Exfiltration Technique

PHASE 05
05
Secrets Exfil via GitHub Actions Build Artifacts
NOVEL TTP
JFrog documented a novel exfiltration mechanism present in IronWorm's codebase: rather than sending secrets directly to C2 infrastructure, the malware serialises stolen secrets into a file with an innocuous name (mimicking lint or formatting output) and uploads it as a GitHub Actions build artifact — accessible to anyone with repo access, without any external C2 traffic.
Exfiltration Method — GitHub Actions Artifact Upload
# Conceptual representation of IronWorm's GitHub Actions exfil mechanism # (as documented by JFrog — not a live exploit POC) # 1. Malware serialises all stolen secrets into a single value # 2. Writes to file with harmless-looking name SECRETS_OUTPUT="eslint-report-20260604.json" # OR: SECRETS_OUTPUT="prettier-diff-output.txt" # 3. In GitHub Actions workflow context, uploads as artifact # Artifact is downloadable by anyone with Actions read access # No external C2 traffic — evades network-layer DLP # Note: JFrog confirmed this mechanism was NOT used in the analysed IronWorm attack # but IS present in the malware's codebase — prepared for future use

The GitHub Actions artifact exfil technique entirely bypasses egress network monitoring. Defenders should audit Actions workflows for unexpected artifact uploads to names that mimic linting or formatting tools, and restrict who can download artifacts from CI workflows in security-sensitive repositories.

🔗

TeamPCP Connection

PHASE 06

JFrog researchers observed identical commit names between IronWorm and the earlier Shai-Hulud campaign attributed to TeamPCP. While researchers could not confirm a definitive technical link, the overlap in commit naming patterns is notable given Shai-Hulud's leaked source code was published on GitHub after the original campaign — opening the possibility that IronWorm is either a direct evolution of TeamPCP's tooling or a copycat using the same commit naming conventions.

CampaignPackagesExfil MethodAttribution
Shai-Hulud (TeamPCP)600+ npm packagesDirect C2 + GitHubTeamPCP (confirmed)
IronWorm36 npm packagesTor C2 + GitHub Actions artifactUnknown (shared commit names)
🛡️

Detection & Response

PHASE 07
07
Immediate Actions for Developer and Security Teams
DEFEND NOW
Ox Security recommends upgrading to fixed releases, rotating all keys, and enabling 2FA on all npm accounts. The full list of affected package names and fixed versions is published in Ox Security's report.
Response Steps
  • 1
    Check Ox Security's affected package list — if any appear in your package.json or package-lock.json at the infected version, treat your environment as compromised.
  • 2
    Rotate all credentials immediately — npm tokens, AWS access keys, OpenAI/Anthropic API keys, SSH keys, and any secrets stored in environment variables or .env files.
  • 3
    Check for unexpected npm publishes — review your npm organisation's publish history for versions you did not authorise. Check npm info <package> --json | jq '.versions' for unexpected version entries.
  • 4
    Enable 2FA on all npm accounts — use TOTP or hardware security key; do not rely solely on Trusted Publishing for CI publishing workflows.
  • 5
    Audit eBPF usage on compromised hosts — run bpftool prog list and compare against known-good baseline. Unexpected eBPF programs may indicate IronWorm's rootkit.
  • 6
    Inspect GitHub Actions artifacts — review recent build artifact names for files mimicking linting or formatting output containing unexpected data volumes.
Detection — Hunt for eBPF Rootkit Activity
# List all loaded eBPF programs (requires root) $ bpftool prog list # Compare against baseline — look for programs with unknown IDs or suspicious names # IronWorm's rootkit may appear as unnamed or generically named eBPF programs # Check for Tor process or unusual outbound connections over Tor ports $ ss -tnp | grep '9001\|9050\|9150' # Check npm publish history for unexpected versions $ npm view <your-package> versions --json
📚

Sources & References

PHASE 08
JFrog Security Research — IronWorm: Shai-Hulud's Rustier Cousin Ox Security — IronWorm Supply Chain Malware Hits npm (affected package list) BleepingComputer — New IronWorm malware hits 36 packages in npm supply-chain attack Endor Labs — Malicious payload in AI SDK Ollama npm package (concurrent attack) StepSecurity — binding.gyp npm supply-chain attack (concurrent JavaScript-based campaign)

Scan for Malicious npm Package Exposure — If your development or CI environment may have installed affected IronWorm packages, use CyberHawk's IOC Scanner to cross-reference known supply-chain IOCs and check your environment for exposure indicators.

→ CyberHawk IOC Scanner  |  → Supply Chain Threat Intel

◈ Stay Connected

Follow CyberHawk Threat Intel for threat intelligence, deployment guides and hands-on SOC tooling content.

🌐 Website ▶️ YouTube ▶️ YouTube (2) 𝕏 Twitter / X ♪ TikTok ✈️ Telegram
🔍 IOC Scanner 🛠️ Live Tools 📚 Courses 🚨 Threat Intel 📝 Blog 📋 SOPs

"They can't exploit you if you are the Exploit."