IronWorm backdoored Arweave ecosystem npm packages

JFrog Security Research disclosed in early June 2026 that a self-propagating worm it named IronWorm had backdoored 36 npm packages, most of them in the Arweave and WeaveDB ecosystem, after compromising the asteroiddao publishing account. Unlike the JavaScript droppers that dominated npm attacks that year, IronWorm was a native Rust implant with a kernel-level rootkit.

The delivery was conventional enough. A preinstall hook executed a 976 KB Linux ELF binary before dependency resolution finished. Everything after that was not. The binary was packed with a modified UPX stub carrying altered magic values, which defeats signature-based unpackers, and every internal string was encrypted with a key unique to its call site, so recovering one string does not help with the next. Bundled with it was an eBPF program that hid the malware's processes and network connections from the kernel's own accounting, and a Tor client that wrapped plain HTTP command-and-control traffic in an onion circuit.

The collector targeted 86 environment variables and more than 20 credential file paths across AWS, GCP, Azure, Kubernetes, Docker, npm, and GitHub, together with a sweep for 2026-era AI provider keys covering Anthropic, OpenAI, Google Gemini, Cohere, Mistral, Groq, and xAI. Separate modules went after cryptocurrency wallets. JFrog noted that the operator had hardcoded his own wallet recovery phrase into the malware's skip list so that it would not rob him, which is how researchers came to have it.

Propagation ran two ways. The worm committed binaries into victims' GitHub repositories as build hooks, attributing the commits to "claude" so they read as AI tooling output, and it replaced GitHub Actions workflows with versions that exfiltrated ${{ toJSON(secrets) }}, attributing those to bot identities such as dependabot. It then abused npm's trusted publishing through OIDC to release poisoned versions under the compromised developers' names. JFrog counted 57 backdated commits across nine compromised GitHub organizations and said it could not match the implant, the rootkit, or the C2 tooling to any known family, indicating a custom-built operation.