The hbsig npm package versions 0.3.1 and 0.3.2 were compromised in the IronWorm campaign, which installs a malicious Rust-based infostealer via a preinstall hook. This malware targets a wide range of developer credentials including cloud providers, object storage, databases, source control, package registries, AI developer tools, and cryptocurrency wallets by injecting malicious JavaScript into the Exodus wallet. It exhibits worm-like propagation by stealing GitHub and NPM credentials to push malicious updates and publish trojanized packages. On Linux, it uses an eBPF kernel rootkit to hide its processes and network connections, making detection difficult. Removal of the package alone does not guarantee full remediation due to potential persistent compromise.

Any system with hbsig versions 0.3.1 or 0.3.2 installed is considered fully compromised. The attacker gains access to a broad range of sensitive credentials including cloud, database, source control, package registry, AI tools, and cryptocurrency wallets. The malware can propagate by pushing malicious code to repositories and publishing trojanized packages, increasing risk to other systems. The use of a kernel rootkit on Linux further complicates detection and removal, potentially allowing persistent unauthorized access and data exfiltration.

There is no official patch or fix available for this malicious package. Immediate removal of the hbsig package versions 0.3.1 and 0.3.2 is required. However, because the system is likely fully compromised, all secrets and keys stored on the affected computer must be rotated from a separate, clean environment. Consider rebuilding or restoring the affected system from a known good backup to ensure removal of all malicious components. Monitor for any suspicious activity related to credential theft or unauthorized repository updates.