Back Kucoin

SlowMist Discovers IronWorm, a Rust supply chain malware targeting Web3 developers

Kucoin • June 4, 2026

Odaily Planet Daily reports that SlowMist posted on X that its threat intelligence system has detected a new Rust-based supply chain malware campaign named IronWorm, which is actively targeting developer environments and the Web3/crypto ecosystem through malicious npm packages. Potential attack behaviors include credential theft, harvesting wallet mnemonics and passwords, GitHub repository tampering, distribution of malicious packages, theft of CI/CD keys, Tor-based command-and-control, and persistent concealment via eBPF rootkits.

SlowMist recommends that security teams audit retroactive commits, suspicious branches, and anomalous build hooks within the repository, as well as commits attributed to automated identities such as claude, dependabot, renovate, or github-actions; remove or deprecate affected package versions, release a clean version, rotate all exposed keys and tokens, review GitHub Actions build artifacts, and rebuild potentially compromised developer or CI systems from clean images. This threat was discovered and analyzed by JFrogSecurity.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Mini Shai-Hulud Supply Chain Attack Targets SAP npm Packages A new supply chain attack, dubbed 'Mini Shai-Hulud', has compromised multiple npm packages related to SAP's Cloud Application Programming Model (CAP). This attack involves injecting malicious preinstall scripts into legitimate packages, which execute during installation to steal sensitive credentials from developers and CI/CD environments. The malware collects data such as GitHub tokens, npm credentials, and cloud secrets, exfiltrating them via public GitHub repositories. Researchers have linked this campaign to the TeamPCP threat actor group, known for similar tactics in previous attacks. At least four SAP-related npm packages have been confirmed as compromised, with the malicious payload being designed to propagate further across the npm ecosystem. The attack is ongoing, and organizations are advised to review their environments for affected packages and rotate any exposed secrets. 753 sources 71

Extracted Entities

SlowMist Discovers IronWorm, a Rust supply chain malware targeting Web3 developers

The full story

Extracted Entities

Attack Types (2)

Malware (1)

MITRE ATT&CK (2)

Platforms (1)

Tools (2)