The hidden front of npm attacks with threaded rootkits eBPF and backdoors that threaten CI CD IDE and credentials

In recent days, the npm ecosystem has suffered a wave of supply chain attacks that combine old and very new techniques: legitimate bundled packages, installation hooks and native binaries running a Rust charger with a kernel-based routkit based on eBPF, as well as variants of self-replicating worms that use stolen credentials to spread between repositories and registrations. The combination of an info-stealer capable of hiding in the kernel and a family of worms reusing credentials makes these incidents not just local infections, but weapons of sustained spread which can compromise from a developer laptop to CI / CD pipelines and cloud productive environments.

The two reported campaigns use different but complementary vectors: one (publicly identified as "IronWorm") publishes stranded packages that run an ELF in Rust by pre-installation hooks; another takes advantage of a less monitored mechanism - a tiny binding.gyp, named by researchers as "Phantom Gyp" - to run code during npm install and thus evade many checks. Both download alternative runtimes (such as Bun) and aggressively seek credentials related to cloud suppliers, cryptomoneda wallets, GitHub Actions runners and IA-based code assistant settings. The goal is double: to exfilter secrets and leave persistent back doors that are activated every time a developer opens a project in an IDE with IA assistance a particularly disturbing vector for the security of modern development.

Beyond technical damage, the implications for trust in the supply chain are profound. These campaigns show that malicious actors can use GitHub not only to store exfiltration, but as an adaptive command and control channel - modifying commitments that contain indicators such as "firedalazer" to change the payload - and that can forge publication metadata (SLSA) to make versions in records seem legitimate. When the platform we use to collaborate becomes a channel to update your own malware, traditional controls on the network and malware scanners stop being enough.

For developers and equipment that depend on npm and GitHub, immediate reactive measures are clear: rotate and revoke exposed credentials, invalidate short tokens and SSH keys, and remove any npm token that may have been issued by committed runners. In the medium term a stricter construction policy must be imposed: setting versions with integrity of lockfile, disabling the automatic execution of installation scripts in development environments ( npm config set ignore-scripts true or its equivalent in other managers), and prefer to build reproducible in ephemeral runners with minimum privileges. It is also critical to enable and review detection mechanisms in the repository, such as the scanning of secrets and the demand for supply-proof (SLSA); the SLSA project website provides practical guidance on how to improve the chain of trust: https: / / slsa.dev /.

In the layer of the operating system, these campaigns show the effectiveness of payloads that use eBPF to hide; if your organization allows it, consider limiting the use of eBPF for unprivileged processes and evaluate the adoption of kernel mechanisms that reduce surface, for example the kernel blocking option (kernel lockdown) in Linux systems, which prevents certain types of hooks and can frustrate process concealment techniques: https: / / www.kernel / doc / html / latest / secure _ boot / lockdown.html. On the telemetry side, prioritize the instrumentation of CI runners to capture processes and sockets, and configure the automatic rotation of tokens emitted through trust publishing flows.

Organizations must also tighten their contribution flows: apply protection of branches with mandatory reviews, require verified signatures for critical commitments, audit accounts with publication permits and limit the ability of runners to issue long-term credentials. In GitHub it is appropriate to activate the scanning of secrets and policies that block mismatches that enter suspicious executable files; the official documentation on secret scanning explains coverage and options that should be reviewed: https: / / docs.github.com / en / code-security / secret-scanning / about-secret-scanning.

Finally, the effective response requires coordination: to notify the affected package holders, to publish clear remediation instructions for users (which versions to revoke or block), and to share IoCs with the community so that security tools incorporate detection of patterns such as commitments signed by suspicious accounts or devices raised from unusual runners. The key lesson is that the security of modern software is no longer just protecting binaries: it is protecting human and automatic flows that publish, compile and distribute code. The resilience of the supply chain will be both technical and procedural.