maliciousCovers 0.1.0Reviewed by BitbisonUpdated 2026-10-15
In 2026, the IronWorm npm worm spread through hijacked packages and stole developer credentials at install time.
Summary
IronWorm is a Rust malware program that steals credentials and spreads through
npm packages and GitHub repositories. JFrog's June 3, 2026, analysis lists
37 affected packages published by the compromised asteroiddao account.
This account describes the campaign and the installation behavior reproduced
in our lab.
Registry timestamps place those 37 releases within three minutes on May 26,
2026: from weavedb-sdk 0.45.3 at 00:57:24 to weavedb-lite 0.1.1 at
00:59:58 Coordinated Universal Time (UTC).
First release metadata,
last release metadata.
The analyzed weavedb-sdk package carried a 976 KB Linux binary invoked by
"preinstall": "./tools/setup". It ran during package installation when
lifecycle scripts were enabled.
npm lifecycle documentation.
JFrog found code targeting 86 environment variables and more than 20 credential
file paths. The malware could upload secrets through Tor, hide processes with
an extended Berkeley Packet Filter (eBPF) rootkit, and commit malicious code
using stolen GitHub credentials. Its npm publishing code exchanged a workflow
identity token for a package publishing token. That path requires a continuous
integration (CI) workflow authorized by the package's
Trusted Publishing configuration.
Removal was incomplete. When checked on October 15, 2026, 33 of JFrog's 37
listed versions were absent from npm's version metadata. Four remained listed
with compromise warnings: cwao 0.5.6, arjson 0.1.4, zkjson 0.8.5 and
weavedb-sdk 0.45.3. Deprecation does not remove a version from the registry.
Where it reached
- JFrog identified 37 npm packages associated with the Arweave and WeaveDB
ecosystem and malicious commits across nine GitHub organizations.
- The binary included injection templates for Python Package Index (PyPI),
Cargo, Conan and vcpkg projects. This capability does not establish that
malicious releases reached each of those registries.
What Bitbison saw
We reproduced the installation behavior with a synthetic package. Its
preinstall script unpacks a bundled binary and runs it with a fixture
.npmrc containing a fake npm token. The
recorded run
contains two findings:
- The unpacked program opened an unexpected network connection.
- Bitbison linked its read of
.npmrc to the outbound connection and raised a
possible credential exposure alert.
The fixture attempts to send the fake token in a request body. The recorded
connection has outbound data and no reply; it does not establish that the
receiving application accepted the request. This reproduction covers the
installation and file-transfer behavior, not the worm's rootkit or propagation.
References
