Asteroiddao hit by network compromise
Incident
Summary
Hide ▲
Show ▼
asteroiddao suffered a compromised-account incident that let malicious npm package versions and repository commits seed a wider supply-chain attack. The account was used to publish packages carrying a Rust ELF binary executed via preinstall. That compromise matters because it turned a trusted publishing identity into an infection path for developers and CI systems consuming npm packages.
Related Happenings
IronWorm npm supply-chain infection and self-propagation
Malware Activity
First: 04.06.2026 18:25
Last: 04.06.2026 18:25
Sources 1
How related:
A new supply-chain attack has infected 36 packages on the Node Package Manager (npm) index with infostealer malware called IronWorm.
About this happening:
The **IronWorm** malware has infected **36 npm packages**, creating a supply-chain risk for developer and CI environments that can leak secrets and receive trojanized updates. It...
IronWorm npm supply-chain infection and self-propagation
Malware ActivityHow related: A new supply-chain attack has infected 36 packages on the Node Package Manager (npm) index with infostealer malware called IronWorm.
About this happening: The **IronWorm** malware has infected **36 npm packages**, creating a supply-chain risk for developer and CI environments that can leak secrets and receive trojanized updates. It...
Miasma GitHub and npm supply-chain campaign
Campaign
First: 02.06.2026 00:38
Last: 02.06.2026 00:38
Sources 1
About this happening:
A **Miasma** supply-chain campaign has spread through **GitHub** and **npm** abuse, compromising **309 GitHub repositories** and widening the risk of credential theft across devel...
Miasma GitHub and npm supply-chain campaign
CampaignAbout this happening: A **Miasma** supply-chain campaign has spread through **GitHub** and **npm** abuse, compromising **309 GitHub repositories** and widening the risk of credential theft across devel...
Red Hat npm Namespace Hijacked in Supply Chain hit by cyberattack
Incident
First: 01.06.2026 20:40
Last: 01.06.2026 20:40
Sources 1
About this happening:
**Red Hat's** official npm namespace was hijacked in a **supply chain attack** that republished **32 packages** in the **@redhat-cloud-services** scope on **June 1**; the maliciou...
Red Hat npm Namespace Hijacked in Supply Chain hit by cyberattack
IncidentAbout this happening: **Red Hat's** official npm namespace was hijacked in a **supply chain attack** that republished **32 packages** in the **@redhat-cloud-services** scope on **June 1**; the maliciou...
JINX-0164 cryptocurrency recruitment-lure campaign
Campaign
First: 28.05.2026 10:54
Last: 28.05.2026 10:54
Sources 1
About this happening:
A **JINX-0164** campaign is targeting **cryptocurrency firms** and developers with **LinkedIn recruiter lures**, a fake meeting-and-fix workflow, and **macOS malware** to steal cr...
JINX-0164 cryptocurrency recruitment-lure campaign
CampaignAbout this happening: A **JINX-0164** campaign is targeting **cryptocurrency firms** and developers with **LinkedIn recruiter lures**, a fake meeting-and-fix workflow, and **macOS malware** to steal cr...
Mouse5212-super-formatter postinstall GitHub exfiltration package
Malware Activity
First: 27.05.2026 18:44
Last: 27.05.2026 18:44
Sources 1
About this happening:
The **mouse5212-super-formatter** npm package is a **malicious infostealer** that can siphon files from **/mnt/user-data**, putting **Anthropic Claude** user data at risk of unaut...
Mouse5212-super-formatter postinstall GitHub exfiltration package
Malware ActivityAbout this happening: The **mouse5212-super-formatter** npm package is a **malicious infostealer** that can siphon files from **/mnt/user-data**, putting **Anthropic Claude** user data at risk of unaut...
Latest development: 29.05.2026 11:10
mouse5212-super-formatter leaked a hardcoded GitHub token, exposing the operator's credential and allowing about seven theft sessions to be observed in the attacker's GitHub repository; the malicious npm package recursively copied files from a victim machine, uploaded them through the GitHub Contents API, and was later removed from npm.
Timeline
-
04.06.2026 18:25 2 articles · 1h ago
IronWorm infects 36 npm packages in a supply-chain attack
Initial DisclosureA supply-chain attack on the Node Package Manager (npm) index infected 36 packages with IronWorm, a Rust-based infostealer that targets 86 environment variables and 20 credential files, hides behind an eBPF kernel rootkit, and communicates over Tor. The attack began from a compromised account named asteroiddao that published malicious package versions and pushed commits, using preinstall execution to seed trojanized releases that could steal credentials and self-propagate through npm. The campaign was detected very early and stopped before it spread to more popular packages on npm.
Show sources
- New IronWorm malware hits 36 packages in npm supply-chain attack — www.bleepingcomputer.com — 04.06.2026 18:25
- New IronWorm malware hits 36 packages in npm supply-chain attack — www.bleepingcomputer.com — 04.06.2026 18:25