IronWorm Rust‑based malware hijacks npm packages and CI/CD pipelines with eBPF stealth
Security researchers discovered IronWorm, a Rust‑written supply‑chain infostealer that repackages malicious npm packages and replaces GitHub Actions workflows to steal cloud, API and Kubernetes credentials. It uses Tor C2, dual payloads, and an eBPF rootkit to hide its activity, raising the threat level for CI/CD and DevSecOps teams.