MalwarePublished 4 Jun 2026Updated 13 Jul 2026

hbsig (npm) · Malicious Code

Affects hbsigSource GCVE Database

Malicious package : remove hbsig and rotate any secrets on hosts that installed it.

Data as of 13 Jul 2026, 09:24 UTC

Classification

Malicious package

Published to npm · OSV MAL-2026-5190

What to do

Remove hbsig from every project, lockfile and image that pulls it in. Treat any host that installed it as compromised: rotate the credentials, tokens and keys it could read, from a clean machine.

Affected software

Product	Affected	Fixed in
npmhbsig	Affected =0.3.2 =0.3.1	Fixed in–

Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.

Description

The hbsig npm package versions 0.3.1 and 0.3.2 were compromised as part of the IronWorm campaign. The malicious package executes a Rust-based infostealer during installation that targets developer credentials for cloud services, databases, source control, package registries, AI tools, and cryptocurrency wallets. It injects malicious code into the Exodus wallet to capture sensitive data and uses worm-like behavior to spread by stealing GitHub and NPM credentials to push malicious updates. Additionally, it employs an eBPF-based kernel rootkit on Linux to hide its presence. Systems with this package installed should be considered fully compromised and require immediate secret rotation from a clean environment.

Impact

Any system with hbsig versions 0.3.1 or 0.3.2 installed is considered fully compromised. The attacker gains access to a broad range of sensitive credentials including cloud, database, source control, package registry, AI tools, and cryptocurrency wallets. The malware can propagate by pushing malicious code to repositories and publishing trojanized packages, increasing risk to other systems. The use of a kernel rootkit on Linux further complicates detection and removal, potentially allowing persistent unauthorized access and data exfiltration.

Defensive guidance

Immediate removal of the hbsig package versions 0.3.1 and 0.3.2 is required. However, because the system is likely fully compromised, all secrets and keys stored on the affected computer must be rotated from a separate, clean environment. Consider rebuilding or restoring the affected system from a known good backup to ensure removal of all malicious components. Monitor for any suspicious activity related to credential theft or unauthorized repository updates.

Summary

The hbsig npm package versions 0.3.1 and 0.3.2 were compromised in the IronWorm campaign, which installs a malicious Rust-based infostealer via a preinstall hook. This malware targets a wide range of developer credentials including cloud providers, object storage, databases, source control, package registries, AI developer tools, and cryptocurrency wallets by injecting malicious JavaScript into the Exodus wallet. It exhibits worm-like propagation by stealing GitHub and NPM credentials to push malicious updates and publish trojanized packages. On Linux, it uses an eBPF kernel rootkit to hide its processes and network connections, making detection difficult. Removal of the package alone does not guarantee full remediation due to potential persistent compromise.

References

Community reviews

Loading reviews…

What to do

Affected software

Description

AI analysisMachine-generated, updated 13 Jul 2026, 09:24 UTC

Technical details

References

Community reviews