IronWorm: the attack that steals credentials and transforms npm into an entry door for malicious packages

A new attack on the npm supply chain has again revealed that package repositories and automated CI flows are privileged targets for actors seeking access to credentials and secrets. JFrog researchers have identified a campaign that infected 36 packages with a nicknamed infostealer IronWorm, a binary written in Rust that combines advanced techniques of persistence and sigil: it is hidden after a keel rootkit based on eBPF and communicates with its operator through the Tor network.

What distinguishes IronWorm is not only his technology, but his strategy of propagation: he steals credentials from committed accounts and then publishes stranded versions of npm packages on behalf of the victims, taking advantage of reliable publication workflows. Attacks up to 86 environment variables and 20 types of credentials files including OpenAI keys and tokens, AWS, Anthropic, npm, vault configuration files, SSH keys and Exodus wallet files, which explains their interest in development environments and CI where such secrets are usually accessible.

The investigators also observe artefacts to evade forensic investigation, such as committed with forged authorship and old timstamps (up to 13 years ago) rewritten to make it look legitimate. A mechanization was also detected using GitHub Actions to consolidate stolen secrets in an inoculated building device, which allows for exfiltration without the need of an external C2 channel - although JFrog indicates that this method was not used in the analyzed campaign, its mere existence changes the risk surface for automated pipelines. You will find JFrog's technical analysis here: rearch.jfrog.com.

The operation shows conceptual similarities with previous campaigns such as Shai Hallud: use of automated publishing to self-replicate and focus on publication credentials. While JFrog does not establish a direct link with TeamPCP or Shai Hallud, the overlap of commit names and technical evolution leave open the possibility that we are facing a new stage of a more sophisticated, consolidated operation with its own infrastructure.

For developers and security equipment the implications are clear and urgent: a single committed token can convert an CI environment or a npm account into a gateway for an epidemic of malicious packages. In addition to the classic risk of theft of secrets in the host, this modus operandi attacks the ecosystem's chain of confidence: packages with legitimate dependencies move to distribute malicious code to thousands of downstream projects.

Immediate actions that should be undertaken include rotating and revoking tokens and affected keys, enabling 2FA in all accounts with publication permits, and updating the parched versions of the packages identified by the analyses. It is also essential to audit CI workflows to identify pre-install scripts or unexpected artifacts, limit access to build artifacts and reduce the exposure of secrets in environment variables. Relevant platform operational guides can help implement specific countermeasures, such as npm documentation and artifacts practices in GitHub Actions: docs.npmjs.com and docs.github.com (GitHub Actions artifacts).

At the technical level of detection, it is appropriate to verify the presence of devices or indicative behaviour of eBPF rootkits (for example, unusual loads in / sys / fs / bpf or suspicious kernel modules / objects), to search for ELF binaries embedded in npm packages, to review publication logs and correlate them with IP addresses, and to monitor unusual Tor outputs or connection patterns from development environments and CI. EDR solutions and behavioral detection rules that identify changes in building processes or preinstall scripts executions increase the likelihood of detecting such operations before they spread.

Organizations and platforms maintain a critical role: npm and CI suppliers should tighten controls on workflows that can publish packages (approval policies, identity verification and publication signatures), improve the detection of packages containing compiled binary and facilitate forced rotation of tokens after incidents. For those who manage repositories and dependencies, adopt practices such as signature of artifacts, continuous monitoring of the supply chain and adoption of integrity frameworks such as SLSA reduces systemic risk.

This incident shows that the attackers invest in sophistication (Rust, rootkits eBPF, Tor) and in stealth tactics (false metadata, use of legitimate pipelines to exfilter). Effective defence requires a combination of the hygiene of credentials, the principle of less privilege in CI, safety reviews on each layer and visibility of build artifacts. For those who want to deepen in complementary analysis and other contemporary attacks detected in npm, please see reports from third parties such as Endor Labs: endorlabs.com and response notices from emerging teams.

The long-term lesson is that software security can no longer be limited to the source code: it requires controls on credentials, pipelines and publishing platforms. Those who develop and maintain packages must assume that, sooner or later, an exposed token can become a mass attack vector and plan accordingly: detection, response and resilience are now part of the software life cycle.