Skip to content

IronWorm

Named by 2 kept items in this workspace.

Search every workspace for IronWorm. It matches the name as written, so it can find other things that share it.

The items that name it 2

  • Cloud Threat Highlights: H1 2026
    writeup2026-08-06

    Campaign that began on npm in early June 2026; used a compiled Rust binary bundled with a C-compiled eBPF rootkit to filter process/network data and conceal itself from user-space tools; routed communications over Tor; a second IronWorm operation emerged in early July.

  • npm-scan
    repo2026-08-05

    Real campaign used to validate npm-scan detectors

All threat actors in this workspace.