SlowMist disclosed on X that its threat intelligence system has detected a new Rust supply chain malware activity named IronWorm. The malware aggressively targets developer environments and the Web3/crypto ecosystem by distributing malicious npm packages. The threat was first discovered and analyzed by JFrogSecurity, followed by SlowMist's security advisory.
IronWorm encompasses a full attack chain: credential theft, extraction of wallet mnemonic phrases and passwords, GitHub repository tampering, publication of malicious packages, and CI/CD key exfiltration. Its command-and-control infrastructure operates over Tor, making it difficult to trace, while it achieves stealthy persistence through an eBPF rootkit that hides deep within the system, evading conventional detection tools.
Comprehensive Penetration Capabilities
Beyond generic credential harvesting, IronWorm specifically targets cryptocurrency wallet seed phrases and private keys, posing a direct risk to user funds. Tampering with GitHub repositories can introduce backdoors into project code, broadening the infection surface. By publishing malicious packages, the malware pollutes the npm ecosystem, ensnaring unsuspecting developers when they pull dependencies. Stolen CI/CD keys grant attackers control over continuous integration pipelines, enabling them to alter build artifacts and inject malicious code into downstream applications.
Defense and Remediation Recommendations from SlowMist
SlowMist urges security teams to immediately audit repositories for suspicious commits, focusing on backdated commits, abnormal branches, anomalous build hooks, and commits made under automated identities such as claude, dependabot, renovate, or github-actions. Affected package versions should be removed or deprecated, a clean version published, and all exposed keys and tokens rotated. Additionally, teams are advised to scrutinize GitHub Actions build artifacts and rebuild potentially compromised developer or CI systems from clean images to completely eradicate the threat.