Question 1

IronWorm이란 무엇이며 어떻게 확산됩니까?

Accepted Answer

IronWorm is a Rust-based infostealer that executes during `npm install` via a preinstall hook. Once it has credentials, it uses stolen GitHub and npm tokens to push malicious commits into the victim's repositories. Other developers who install those compromised packages get infected next.

Question 2

어떤 npm 패키지들이 IronWorm 공격으로 인해 피해를 입었습니까?

Accepted Answer

The attack compromised 36 packages published under the "asteroiddao" npm account, all tied to the Arweave/WeaveDB ecosystem. That includes weavedb-sdk version 0.45.3 and related packages listed in JFrog's research disclosure.

Question 3

IronWorm은 어떤 자격 증명을 탈취합니까?

Accepted Answer

The malware targets 86 environment variables and 20 credential files. That includes AWS tokens, OpenAI and Anthropic API keys, npm authentication secrets, SSH keys, and Exodus cryptocurrency wallet files.

Rust

공격자가 Arweave의 WeaveDB npm 패키지를 트로이 목마로 변조하여 악성코드를 배포했습니다.

날카로운 한 줄.
매일.

Rust

공격자가 Arweave의 WeaveDB npm 패키지를 트로이 목마로 변조하여 악성코드를 배포했습니다.

날카로운 한 줄.매일.

날카로운 한 줄.
매일.