IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks
A sophisticated supply chain attack targeting the npm ecosystem has resulted in the deployment of both IronWorm, a Rust-based information stealer with self-replicating capabilities, and a new variant of the Miasma worm. The attacks leveraged compromised npm accounts to inject malicious packages containing credential harvesting and rootkit functionalities, aiming to steal sensitive data from developers' machines and GitHub repositories. This highlights the vulnerability of software supply chains and the potential for widespread compromise.
The recent attacks involved the distribution of malicious npm packages, utilizing a technique known as 'Phantom Gyp' to bypass security checks during the npm install process. IronWorm, developed by JFrog, operates by scraping secrets, hiding behind an eBPF kernel rootkit, and propagating through stolen credentials. The attack originated from a compromised npm account, 'asteroiddao,' and spread across nine GitHub organizations, mimicking Anthropic's AI chatbot to further obfuscate its activity. The malware targeted a wide range of environment variables and credentials associated with various cloud providers and development tools. Simultaneously, the Miasma worm, previously impacting 32 packages, resurfaced with a new variant, compromising 57 npm packages across 286 versions. This second wave utilized a similar 'Phantom Gyp' technique to inject malicious code and steal credentials from repositories. The exfiltration point for the Miasma worm was a GitHub account, 'liuende501,' which contained staging of 236 repositories. Both attacks underscore the importance of robust supply chain security measures and continuous monitoring of npm packages.