IronWorm Credential Theft via npm/node Spawned Process Reading Browser and Secret Stores

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects unauthorized access to browser credential databases, cloud configuration files, and developer secret stores by processes spawned from Node.js or npm. This behavior is indicative of IronWorm and similar infostealers exploiting malicious npm package preinstall hooks to harvest sensitive developer credentials.