The Hacker NewsSaturday · June 6, 2026FREE

IronWorm and New Miasma Worm Variant Hit npm in Supply Chain Attacks

The npm ecosystem has been targeted by multiple software supply chain attacks, as reported by The Hacker News, citing JFrog. These incidents involved threat actors distributing a Rust-based information stealer and a self-spreading worm through over 50 malicious or poisoned versions of legitimate npm packages. The information stealer, referred to as 'IronWorm' in the title, is designed to scrape all discoverable secrets from a developer's machine, potentially compromising sensitive credentials, API keys, and other critical data. It further enhances its stealth by utilizing an eBPF kernel rootkit, making it difficult to detect and remove from compromised systems. Concurrently, a new variant of the 'Miasma Worm,' also mentioned in the title, is being distributed, capable of self-propagation within affected systems, aiming to spread the infection further across the network. The attackers leveraged both entirely malicious packages and poisoned versions of existing, trusted packages to maximize their reach and evade detection. These sophisticated attacks underscore persistent vulnerabilities within the software supply chain, where widely used package managers like npm can become vectors for distributing advanced malware. The strategy of mimicking or corrupting legitimate package names makes these threats particularly challenging to identify, emphasizing the critical need for enhanced security measures and vigilance among developers and organizations relying on npm packages for their projects.