IronWorm eBPF Rootkit Loaded by npm/node Process on Linux

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects IronWorm rootkit activity on Linux, specifically focusing on cases where npm or node processes spawn tools like bpftool, insmod, or modprobe to load eBPF programs or kernel modules. It also flags the usage of specific IronWorm-associated filenames (q2.bpf, libbpf) within directories managed by npm or node.