Rust-Written IronWorm Hits NPM Supply Chain

IronWorm is a Rust-based malware campaign targeting developers and the open-source software supply chain: it steals API keys, cloud credentials, SSH keys and npm tokens, uses an eBPF rootkit to hide processes/files/network activity, communicates over Tor C2, and was found in at least 36 npm packages (≈32,000 monthly downloads) with multiple malicious commits before mitigation.