IronWorm and Miasma Worm Attack npm Packages

IronWorm and Miasma Worm target npm packages with malicious Rust binaries. The malware scrapes 86 environment variables and steals credentials for OpenAI Codex, Anthropic, Claude, Google Gemini, AWS, Docker, Kubernetes, npm, vaults, and Exodus wallets. It uses a compromised npm account named asteroiddao and spreads via preinstall hooks. The attack mimics Anthropic's AI chatbot under author name [email protected]. The stolen wallet data is empty with no transactions recorded.