Rust-Written IronWorm Hits NPM Supply Chain
A new Rust-written malware campaign, dubbed "IronWorm," is targeting developers through compromised npm publishing workflows, stealing credentials like API keys and cloud credentials to spread across the software supply chain. The malware utilizes an eBPF rootkit and unique encryption, making it difficult to detect, and is linked to the Shai-Hulud campaign. This highlights the increasing vulnerability of software supply chains and the importance of secure development practices.
The IronWorm campaign emerged as part of a broader trend of supply chain attacks targeting the open-source software ecosystem. JFrog identified the activity while investigating suspicious behavior linked to an Arweave/WeaveDB developer account, revealing a sophisticated operation focused on stealing developer credentials and propagating malicious code. The malware, written in Rust, employs a rootkit leveraging the Linux kernel's eBPF to evade detection and utilizes unique encryption keys to obfuscate its code. Researchers at OX Security confirmed the impact of the campaign, noting that it affected over 36 npm packages with more than 32,000 combined monthly downloads, though the threat was contained before wider spread.
The operator of IronWorm took steps to conceal their activity, silently removing malicious packages from GitHub and making numerous code changes to affected repositories. This backdated approach aimed to complicate forensic analysis. JFrog’s analysis suggests that IronWorm is a custom-built implant, representing a highly sophisticated operation, with similarities to the Shai-Hulud campaign, which focuses on compromising developers and leveraging trusted software supply chains. This attack underscores the risk posed by developers holding privileged access to critical systems and repositories.