IronWorm self-propagating malware hits 36 npm packages (2026)

On 4 June 2026, researchers at JFrog disclosed IronWorm, a self-propagating supply-chain attack that infected 36 packages on the npm registry with infostealer malware. Unlike typical obfuscated-JavaScript npm threats, IronWorm is written in Rust and hides inside a binary executable triggered by an install script, communicating with its operator over the Tor network.

What happened

According to JFrog, the campaign began from a compromised npm account named asteroiddao, which published package versions carrying a Rust ELF binary executed during installation. The malware harvests dozens of environment variables and credential files that may contain OpenAI, AWS, Anthropic, and npm tokens, vault configuration files, SSH keys, and cryptocurrency wallet files.

Crucially, IronWorm self-propagates: once it lands in a developer or CI environment, it uses stolen npm credentials — including secrets tied to npm's Trusted Publishing workflow — to publish trojanized versions of packages the victim owns, infecting further developers and pipelines downstream. JFrog published the full list of affected packages and urged developers to upgrade to fixed releases, rotate keys, and enable two-factor authentication.

Why it matters

A worm that turns each compromised maintainer into a launchpad for the next is the supply-chain nightmare scenario: the blast radius grows automatically, and stolen CI tokens let it jump from one trusted publisher to another. IronWorm's use of a compiled Rust binary and Tor command-and-control also raises the bar for detection compared with the script-based package attacks defenders have grown used to.