SlowMist: New Rust Supply Chain Malicious Activity IronWorm Attacks Web3 Ecosystem Through npm Packages

On June 4, according to SlowMist monitoring, a new Rust supply chain malware campaign named IronWorm is attacking developer environments and the Web3 ecosystem through malicious npm packages. Potential attack behaviors include credential theft, wallet mnemonic and password theft, GitHub repository tampering, malicious package publishing, CI/CD secret leakage, Tor-based command and control, and eBPF rootkit stealth. Security teams should audit rollback commits, suspicious branches, unexpected build hooks, and commits from automated identities such as claude, dependabot, renovate, or github-actions in their repositories. It is recommended to remove or deprecate affected package versions, publish clean versions, rotate all leaked keys and tokens, review GitHub Actions artifacts, and rebuild potentially compromised development or CI systems from clean images.