Tracked campaign · npm

IronWorm

Self-replicating npm worm written in Rust. Ships a compiled binary via preinstall. Steals 86 env vars + 20 credential files, beacons over Tor, hides behind an eBPF rootkit, propagates via npm Trusted Publishing.

16 packages attributednpm ecosystemexternal source

First seen 2025-06-05

Attribution basis

These are the signal classes linking the members of this campaign — the broad evidence categories we use to attribute a package, not the raw indicators themselves.

shared malware fingerprint

Sample attributed packages

cc-pets@0.2.2
cc-pets@0.2.1
cc-pets@0.2.0
react-tabulix-core@0.1.1
cc-pets@0.1.1
cc-pets@0.1.0
my-postinstall-pkg@1.0.0
@threshold-network/solidity-contracts@1.2.1
termux-connecting@1.1.4
nextfile-js@1.4.2
lockfile-js@1.4.2
js-digest@4.2.2
mox-cli@8.0.1
mox-cli@8.0.0
@transitive-sdk/utils-ros@0.12.2
@transitive-sdk/utils-ros@0.12.3

PkgRadar attributes coordinated supply-chain campaigns and blocks their packages at the CI gate. Start free or see all tracked campaigns.