SlowMist Detects Rust Supply Chain Malware IronWorm Targeting Web3 Developer Environments

SlowMist has issued an alert on X about a new Rust supply chain malware campaign named IronWorm, detected by its threat intelligence system. The malware actively targets developer environments and the Web3/crypto ecosystem through malicious npm packages.

Attack Behaviors and Capabilities

Potential attack behaviors include credential theft, stealing wallet mnemonics and passwords, tampering with GitHub repositories, publishing malicious packages, exfiltrating CI/CD keys, employing Tor-based command and control, and achieving stealthy persistence via an eBPF rootkit. These techniques demonstrate a high level of sophistication, allowing the malware to remain undetected for extended periods.

Security Recommendations

SlowMist advises security teams to audit their code repositories for backdated commits, suspicious branches, abnormal build hooks, and commits attributed to automated identities such as claude, dependabot, renovate, or github-actions. These identities are often abused by attackers to disguise malicious activities.

Teams should also remove or deprecate affected package versions and publish clean versions; rotate all exposed keys and tokens; review GitHub Actions build artifacts for any residual malicious payloads; and rebuild potentially compromised developer or CI/CD systems from clean images.

The threat was initially discovered and analyzed by JFrogSecurity, with SlowMist subsequently issuing a focused warning to the Web3 community based on its cryptocurrency expertise.