New IronWorm malware attacks 36 packages in npm supply chain attack

A brand new provide chain assault contaminated 36 packages on the Node Package deal Supervisor (npm) index with information-stealing malware referred to as IronWorm.

The malware targets 86 atmosphere variables (key-value pairs) and 20 credential information which will embody OpenAI, AWS, Anthropic, npm credentials, vault configuration information, SSH keys, and Exodus cryptocurrency pockets information.

Based on researchers at provide chain and devops firm JFrog, IronWorm is written in Rust, hides behind the eBPF kernel rootkit, and communicates with operators over the Tor community.

Rust-based malware self-propagates utilizing stolen credentials for publication on npm. This consists of secrets and techniques associated to npm’s trusted publishing workflow.

Compromising a developer or CI atmosphere can expose trojanized variations of packages owned by the sufferer, probably infecting extra builders or CI techniques.

This habits is conceptually just like Shai Hulud, whose code was lately revealed on GitHub. JFrog researchers discovered no clear connection between IronWorm and Shai Hulud, however noticed the presence of the identical commit identify in each provide chain assaults.

This raises the chance that the brand new malware is an evolution of TeamPCP’s payload, as IronWorm seems to be a “customized implant rigorously constructed by working utilizing its personal infrastructure.”

Based on JFrog, the most recent assault started with a compromised account named “asteroiddao” that revealed a package deal model containing a Rust ELF binary that ran through “preinstall” and pushed malicious commits to the repository.

The commit writer is proven as “claude” and the timestamps level again a number of years, in some circumstances as much as 13 years, despite the fact that they had been pushed up to now few days. That is more likely to evade investigation.

One notable factor of JFrog’s findings is the mechanism that depends on GitHub Actions to ship stolen secrets and techniques. JFrog explains that the malware serializes the key right into a single worth and “writes it to a file with an innocuous-looking identify, as if it had been a lint or formatted output.”

The ultimate step within the course of is to add the file as a construct artifact. This may be downloaded by anybody with entry. On this method, menace actors can fully keep away from the necessity for exterior command and management (C2).

Nevertheless, the researchers notice that this supply mechanism was not used within the IronWorm provide chain assaults analyzed.

One other anomaly found is that the operator hardcoded the restoration phrase for his cryptocurrency pockets. Researchers say the one motive for that is that the attackers didn’t need the malware to steal information throughout the testing part.

Software safety firm Ox Safety says the IronWorm assault was detected very early and stopped earlier than it may unfold to extra widespread packages on npm.

The corporate offers a listing of all affected package deal names and their variations within the report, recommending that builders improve to a repair launch, rotate keys, and allow two-factor authentication (2FA) on all accounts.

On the identical time, Endor Labs and StepSecurity found a really related however distinct assault occurring across the identical time that concerned JavaScript-based malware named binding.gyp and carried out registry poisoning and GitHub Actions infections.