Threat actors are targeting the npm ecosystem with sophisticated supply chain attacks, deploying IronWorm and Miasma malware to steal developer credentials and propagate malicious code across GitHub repositories.

Key Points

• The IronWorm malware uses an eBPF kernel rootkit to scrape secrets from 86 environment variables, including AWS, Docker, Kubernetes, and various AI coding assistant configurations.
• Attackers compromised the "asteroiddao" npm account to inject malicious Rust-based binaries that self-replicate by pushing unauthorized commits to GitHub organizations.
• A separate campaign involving the Miasma worm utilizes a "Phantom Gyp" technique to bypass standard security monitoring by executing code through binding.gyp files during installation.
• The Miasma variant targets CI/CD environments by scraping GitHub Actions runner memory and abusing Trusted Publishing flows to distribute poisoned packages.
• Security researchers identified that these attacks leverage legitimate platforms like GitHub as adaptive command-and-control infrastructure to evade traditional network-level detection.

Why it Matters

These attacks represent a significant escalation in software supply chain threats by weaponizing trusted developer tools and AI coding assistants to harvest high-value credentials. By automating propagation and bypassing standard security scripts, these campaigns pose a severe risk to both individual developers and enterprise CI/CD pipelines.