Malicious npm Packages Deliver Rust Stealer
Security researchers have uncovered a significant supply chain attack targeting the npm ecosystem. Threat actors compromised a legitimate npm account and published over 50 malicious or poisoned package versions. These packages contain a Rust-based information stealer that executes through a preinstall hook once a developer installs the trojanized code.
The stealer, named IronWorm by researchers at JFrog, is designed to scrape credentials from a developer’s machine. It targets 86 environment variables and specific files related to services like OpenAI Codex, Anthropic Claude, Google Gemini, AWS, Docker, Kubernetes, and the Exodus cryptocurrency wallet. The malware uses stolen credentials to propagate further, publishing new malicious packages to the npm registry in a self-replicating attack pattern.
Self-Propagation and Impact
IronWorm operates with an eBPF kernel rootkit to hide its presence and communicates with its operator over the Tor network. The malware also modifies projects on GitHub to inject malicious code, spreading across repositories under nine different GitHub organizations. The malicious commits were attributed to an author name mimicking Anthropic’s AI chatbot, suggesting an attempt to evade suspicion.
Researchers traced the attack back to a compromised npm account linked to a GitHub organization. The cryptocurrency wallet targeted by the malware remains empty, with no recorded transactions. This incident highlights the growing sophistication of supply chain attacks that exploit developer trust and automated package distribution systems.
Source: The Hacker News
