The stolen key to the package registry allowed the attacker to upload five infected versions of jscrambler with IronWorm malware into the NPm. The attack was studied by experts Socket, JFrog, SafeDep and StepSecurity.
Socket noticed the first malicious version six minutes after publication, linked to the campaign four more issues and found that in the later versions the downloader was moved from preinvest in the main code. JFrog has determined malware as IronWorm and has found a self-distribution mechanism through stolen npm tokens.
SafeDep confirmed Lack of added files in open repository and revealed the possibility of loading the eBPF code into the Linux kernel. StepSecureity recorded Refers to two IP addresses and Tor infrastructure.
The versions 8.14.0, 8.16.0, 8.17.0, 8.18.0 and 8.20.0, released in three hours were infected. Jscrambler Confirms compromising the credentials for publication. The attack only affected the main jscrambler package for Code Integrity. Other products and plugins were not affected.
The first three versions were run malware through preinstall during installation. In versions 8.18.0 and 8.20.0, the bootloader was built into the main code and interface of the command line, so the ban on installation scenarios was no longer protected. The program worked when connecting or running a packet. Separate executable files were used for Windows, macOS and Linux.
IronWorm searched for cloud keys, npm and GitHub tokens, browser passwords and cookies, 1Ppass and Bitwarden storage, crypto wallets, VPN configurations, instant messenger sessions, as well as keys of programming tools with MCP and MCP servers. In Windows, the malware was fixed through the hidden task of the planner, in the macOS via LaunchAgent. The data was transmitted through Tor and temp.sh.
JFrog also found that IronWorm checked the found tokens npm, chose popular packages, implemented setup.mjs in the archives and could publish the infected versions directly in the register. Confirmations of infection of other bags are not yet available.
Jscrambler withdrew the publications, changed secrets and marked the malicious versions as outdated, but they can be installed at the exact number. The company calls the full release of 8.22.0.
Users are advised to go to 8.22.0, remove dangerous versions from lock files and cashies, check the workstations and assembly systems. The keys and tokens available to the liar should be considered stolen, changed, complete active sessions and check Windows for hidden tasks, and macOS on unknown LaunchAgent.
Socket noticed the first malicious version six minutes after publication, linked to the campaign four more issues and found that in the later versions the downloader was moved from preinvest in the main code. JFrog has determined malware as IronWorm and has found a self-distribution mechanism through stolen npm tokens.
SafeDep confirmed Lack of added files in open repository and revealed the possibility of loading the eBPF code into the Linux kernel. StepSecureity recorded Refers to two IP addresses and Tor infrastructure.
The versions 8.14.0, 8.16.0, 8.17.0, 8.18.0 and 8.20.0, released in three hours were infected. Jscrambler Confirms compromising the credentials for publication. The attack only affected the main jscrambler package for Code Integrity. Other products and plugins were not affected.
The first three versions were run malware through preinstall during installation. In versions 8.18.0 and 8.20.0, the bootloader was built into the main code and interface of the command line, so the ban on installation scenarios was no longer protected. The program worked when connecting or running a packet. Separate executable files were used for Windows, macOS and Linux.
IronWorm searched for cloud keys, npm and GitHub tokens, browser passwords and cookies, 1Ppass and Bitwarden storage, crypto wallets, VPN configurations, instant messenger sessions, as well as keys of programming tools with MCP and MCP servers. In Windows, the malware was fixed through the hidden task of the planner, in the macOS via LaunchAgent. The data was transmitted through Tor and temp.sh.
JFrog also found that IronWorm checked the found tokens npm, chose popular packages, implemented setup.mjs in the archives and could publish the infected versions directly in the register. Confirmations of infection of other bags are not yet available.
Jscrambler withdrew the publications, changed secrets and marked the malicious versions as outdated, but they can be installed at the exact number. The company calls the full release of 8.22.0.
Users are advised to go to 8.22.0, remove dangerous versions from lock files and cashies, check the workstations and assembly systems. The keys and tokens available to the liar should be considered stolen, changed, complete active sessions and check Windows for hidden tasks, and macOS on unknown LaunchAgent.
