IronWorm

It uses those stolen tokens to compromise additional packages... If an attacker gains those credentials, they push malicious code under your name.

Экосистема npm пострадала от новой атаки на цепочку поставок... инфостилер IronWorm успел заразить 36 пакетов... Получив доступ к машине разработчика или CI/CD-среде, вредонос использует похищенные учетные данные для публикации новых зараженных пакетов в npm.

Multiple software supply chain attacks have hit the npm ecosystem, with threat actors using both malicious and poisoned versions of over 50 legitimate packages to distribute a Rust-based information stealer and a self-spreading worm, respectively.

The malicious activity has been traced back to a compromised npm account named "asteroiddao," which has been found to publish package versions containing the Rust ELF binary that's executed via a preinstall hook.

The package.json gave away the trick: { "scripts" : { "preinstall" : "./tools/setup" } } preinstall runs before npm even starts resolving dependencies.

...были опубликованы версии пакетов с вредоносным Rust-бинарником, который запускался на этапе preinstall...

It uses those stolen tokens to compromise additional packages... If an attacker gains those credentials, they push malicious code under your name.

the malicious payload is equipped to swap existing GitHub Actions workflows for one that's capable of harvesting the secrets, writing it to a harmless-looking file, and uploading it as a build artifact

It uses those stolen tokens to compromise additional packages... If an attacker gains those credentials, they push malicious code under your name.

...маскирует свою активность с помощью eBPF-руткита.

The sample was a Linux ELF executable packed with a lightly modified UPX stub... The sample also hid most of its useful strings... each call site used its own parameters.

The payload was placed under an innocuous-looking path such as tools/setup or .github/scripts/precheck . This was committed under the author name claude <claude@users.noreply.github.com> ... Workflow commits are using a rotating cast of familiar automation identities - dependabot , renovate , github-actions.

It uses those stolen tokens to compromise additional packages... If an attacker gains those credentials, they push malicious code under your name.

This component works as a Linux kernel rootkit that helps to hide the malware’s processes and network activity.

When anything in /proc was listed , the rootkit rewrote the results in place, removing hidden PIDs before userland tools could see them.

The rootkit parsed /proc/net/tcp as it was read and removed rows belonging to hidden sockets. It also applied similar filtering to the netlink interface used by tools like ss

...были опубликованы версии пакетов с вредоносным Rust-бинарником, который запускался на этапе preinstall...

the malicious payload is equipped to swap existing GitHub Actions workflows for one that's capable of harvesting the secrets, writing it to a harmless-looking file, and uploading it as a build artifact

The credential sweep is exhaustive. The binary reaches for 86 environment variables spanning every major platform... source-control and package-registry tokens, CI/CD systems, messaging platforms, Vault and Kubernetes.

Малварь нацелена на кражу... SSH-ключи, конфигурации хранилищ и файлы криптовалютных кошельков Exodus.

It harvests high-value Linux development secrets—SSH keys, cloud tokens, package publishing credentials.

the malicious payload is equipped to swap existing GitHub Actions workflows for one that's capable of harvesting the secrets, writing it to a harmless-looking file, and uploading it as a build artifact

Малварь нацелена на кражу 86 переменных окружения... учетные данные от сервисов OpenAI, AWS, Anthropic и npm, SSH-ключи, конфигурации хранилищ... Среди украденных данных встречаются и секреты, используемые механизмом Trusted Publishing.

Малварь нацелена на кражу 86 переменных окружения (пары key-value)...

The ${{ toJSON(secrets) }} expression serializes the secrets available to the workflow run into a single value; the next step writes it to a file with a harmless-looking name.

The malware was also found to accept commands for uploading secrets, dropping files and running remote shells through a Tor-based command-and-control (C2) setup.

Then it beacons out to an endpoint called /api/agent ... The conversation itself is plain HTTP wrapped inside the Tor tunnel

the information stealer "scrapes every secret it can find on a developer's machine, hides behind an eBPF kernel rootkit, and answers to its operator over Tor."

IronWorm написан на Rust, взаимодействует со своими операторами через Tor...

The malware was also found to accept commands for uploading secrets, dropping files and running remote shells through a Tor-based command-and-control (C2) setup.

The malware was also found to accept commands for uploading secrets, dropping files and running remote shells through a Tor-based command-and-control (C2) setup.

The malware was also found to accept commands for uploading secrets... through a Tor-based command-and-control (C2) setup. ... the attacks share similarities including self-propagation and exfiltration of data to GitHub.

the final step uploads that file as a build artifact, where it can be downloaded by anyone with sufficient access... Another piece of code suggests a possible fallback path... The agent uploads it to temp.sh , a public file host

...механизм эксфильтрации данных через GitHub Actions... вредонос способен собирать похищенные секреты в единый файл... а затем загружать как build artifact.