Threats Tagged 'mal-2026-5190'

The hbsig npm package versions 0.3.1 and 0.3.2 were compromised as part of the IronWorm campaign. The malicious package executes a Rust-based infostealer during installation that targets developer credentials for cloud services, databases, source control, package registries, AI tools, and cryptocurrency wallets. It injects malicious code into the Exodus wallet to capture sensitive data and uses worm-like behavior to spread by stealing GitHub and NPM credentials to push malicious updates. Additionally, it employs an eBPF-based kernel rootkit on Linux to hide its presence. Systems with this package installed should be considered fully compromised and require immediate secret rotation from a clean environment.