Question 1

什么是 IronWorm，它是如何传播的？

Accepted Answer

IronWorm is a Rust-based infostealer that executes during `npm install` via a preinstall hook. Once it has credentials, it uses stolen GitHub and npm tokens to push malicious commits into the victim's repositories. Other developers who install those compromised packages get infected next.

Question 2

哪些 npm 包受到了 IronWorm 攻击的影响？

Accepted Answer

The attack compromised 36 packages published under the "asteroiddao" npm account, all tied to the Arweave/WeaveDB ecosystem. That includes weavedb-sdk version 0.45.3 and related packages listed in JFrog's research disclosure.

Question 3

IronWorm 会窃取哪些凭据？

Accepted Answer

The malware targets 86 environment variables and 20 credential files. That includes AWS tokens, OpenAI and Anthropic API keys, npm authentication secrets, SSH keys, and Exodus cryptocurrency wallet files.

Tor

微软警告 Windows 加密剪贴板窃取器通过 Tor 和 USB 驱动器窃取助记词、密钥和钱包

攻击者对Arweave的WeaveDB npm包进行了特洛伊木马化处理以部署恶意软件

一份犀利简报。
每天。

Tor

微软警告 Windows 加密剪贴板窃取器通过 Tor 和 USB 驱动器窃取助记词、密钥和钱包

攻击者对Arweave的WeaveDB npm包进行了特洛伊木马化处理以部署恶意软件

一份犀利简报。每天。

一份犀利简报。
每天。