
IronWorm and Miasma Worm target npm packages with malicious Rust binaries. The malware scrapes 86 environment variables and steals credentials for OpenAI Codex, Anthropic, Claude, Google Gemini, AWS, Docker, Kubernetes, npm, vaults, and Exodus wallets. It uses a compromised npm account named asteroiddao and spreads via preinstall hooks. The attack mimics Anthropic's AI chatbot under author name [email protected]. The stolen wallet data is empty with no transactions recorded.
Tap to vote and see what everyone thinks.
Red Hat npm packages compromised to steal developer credentials
Summary by ByteBrief