fpjson-lang version 0.1.7 is compromised by the IronWorm campaign, which embeds a malicious Rust-built binary executed at npm install time via a preinstall hook. This binary acts as an infostealer targeting a wide range of developer-related credentials and cryptocurrency wallets, including injecting malicious hooks into the Exodus wallet. It also uses an eBPF-based kernel rootkit on Linux to hide its presence and exhibits worm-like propagation by stealing GitHub and npm credentials to push trojanized updates. The package's legitimate JavaScript code is minimal and unrelated to the malicious payload, which is opaque and packed, indicating a deliberate install-time dropper pattern. Systems with this package installed should be considered fully compromised.

Systems installing fpjson-lang 0.1.7 are subject to arbitrary code execution at install time, leading to full system compromise. The malware steals sensitive credentials for cloud providers, databases, source control, package registries, AI tools, and cryptocurrency wallets. It can maintain persistence via a kernel rootkit and propagate by compromising developer repositories and publishing malicious packages. This results in significant risk of data theft, credential leakage, and further supply chain compromise.

No official patch or fix is currently available. Users should immediately remove fpjson-lang version 0.1.7 from their environments. Due to the high likelihood of full system compromise, all secrets and keys stored on affected machines must be rotated from a separate, trusted device. Comprehensive incident response and system remediation are recommended, including forensic analysis and potential system rebuilds. Monitor for any signs of persistence or further compromise. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.