IronWorm, a Rust-Based npm Infostealer, Hides Behind an eBPF Rootkit and Tor C2 While Self-Propagating Through Stolen Credentials
JFrog disclosed IronWorm, a self-propagating npm worm written in Rust that uses an eBPF rootkit, Tor command-and-control, and stolen credentials to spread.
Overview
A new supply-chain attack has infected 36 packages on the npm registry with an infostealer called IronWorm, according to BleepingComputer. Unlike the JavaScript droppers that have dominated recent npm compromises, IronWorm is written in Rust, hides behind an eBPF kernel rootkit, and communicates with its operator over the Tor network, per BleepingComputer. The campaign was identified and analyzed by researchers at JFrog, GBHackers reports.
The malware marks an escalation in tooling sophistication for registry-borne attacks, combining credential theft, kernel-level concealment, and worm-like self-propagation in a single compiled binary.
What We Know
The attack was first observed in npm packages published by the account “asteroiddao,” linked to the asteroid-dao GitHub organization within the Arweave ecosystem, according to GBHackers. BleepingComputer reports that JFrog traced the campaign to that compromised account, which published package versions containing a Rust ELF binary.
Once installed, IronWorm scans the host for credentials. According to BleepingComputer, the malware targets 86 environment variables and 20 credential files that may contain OpenAI, AWS, Anthropic, and npm credentials, vault configuration files, SSH keys, and Exodus cryptocurrency wallet files. JFrog’s analysis enumerates more than twenty credential paths spanning cloud providers, AI and machine-learning API keys, and crypto wallets, as detailed in its research writeup.
The binary itself is engineered for stealth. JFrog describes a 976 KB Linux binary tucked into a tools/ directory and executed through npm’s preinstall hook, which runs before npm even starts resolving dependencies, in its technical breakdown. To frustrate analysis, the operator overwrote the UPX magic value so standard unpackers could not detect the file, and encrypted internal strings on a per-call-site basis so that no single key could unlock them at once, JFrog notes in the same writeup.
At the system level, the malware deploys an eBPF-based rootkit that hides processes and network connections and interferes with debugging by manipulating kernel-level telemetry, according to GBHackers. For command and control, JFrog reports that the malware downloads the Tor expert bundle, starts the daemon, and then beacons out to an endpoint called /api/agent to await orders, per its research.
The worm spreads by weaponizing the credentials it steals. BleepingComputer reports that the Rust-based malware self-propagates by using stolen credentials to publish on npm, including secrets associated with npm’s Trusted Publishing workflow. On the GitHub side, stolen credentials are used to inject malicious commits into accessible repositories, with those commits either introducing build-time execution hooks or replacing existing GitHub Actions workflows with secret-harvesting pipelines, according to GBHackers.
JFrog framed IronWorm as a relative of an earlier campaign, titling its analysis “IronWorm: Shai-Hulud’s rustier cousin” in its research post. The Machine Herald previously reported on a mini-Shai-Hulud worm that compromised TanStack, Mistral AI, and UiPath packages, and on npm’s subsequent staged-publishing controls intended to slow such attacks.
What We Don’t Know
No CVE identifier has been assigned to IronWorm, as the campaign is a credential-theft and propagation operation rather than a single software flaw. The full downstream impact, including how many developer and CI environments ultimately ran the binary, is not detailed in the cited reporting.
The operator also left clues that remain only partly explained. BleepingComputer reports that the commit author appears as “claude,” and that timestamps point to several years ago, up to 13 years in some cases, even though the commits were pushed in the past few days. In an apparent operational-security lapse, the operator hardcoded the recovery phrase of their own cryptocurrency wallet, BleepingComputer notes; JFrog identifies it as a complete twelve-word BIP-39 recovery phrase left in plaintext in its analysis.
Analysis
IronWorm reflects a broader maturation of supply-chain malware. Where earlier npm worms relied on obfuscated JavaScript and install scripts, a compiled Rust binary paired with an eBPF rootkit and Tor C2 raises the bar for both stealth and forensic difficulty. JFrog’s broader tally counted 38 malicious npm packages across 9 GitHub organizations with 57 backdated commits, according to its research — a reminder that the headline package count understates the campaign’s reach into the wider developer ecosystem. The targeting of AI-provider API keys alongside traditional cloud and wallet credentials underscores how thoroughly machine-learning secrets have become a first-class objective for registry attackers.