New Rust-based supply chain malware IronWorm targets the Web3 ecosystem through npm packages

ChainCatcher report: According to SlowMist monitoring, a new Rust supply chain malware campaign named IronWorm is targeting developer environments and the Web3 ecosystem via malicious npm packages. Potential attack behaviors include credential theft, theft of wallet mnemonics and passwords, GitHub repository tampering, distribution of malicious packages, leakage of CI/CD secrets, Tor-based command and control, and eBPF rootkit stealth. Security teams should audit repositories for retroactive commits, suspicious branches, unexpected build hooks, and commits attributed to automated identities such as claude, dependabot, renovate, or github-actions. It is recommended to remove or deprecate affected package versions, release clean versions, rotate all compromised keys and tokens, review GitHub Actions artifacts, and rebuild potentially compromised development or CI systems from clean images.