ShadowFeed Weekly #1 | Web3 Security Intelligence
June 5 — June 11, 2026
ShadowFeed is a real-time Web3 security intelligence service for developers and security researchers. This weekly is the free edition. Pro ($29/mo) includes daily briefings, real-time alerts, and IOC data feeds.
1. IronWorm: One npm install Infected 57 Repositories
IronWorm deployed 36+ malicious npm packages targeting Web3 developers. After stealing 86 environment variables, it used exfiltrated GitHub Tokens to push backdoor commits across 57 repositories in 9 organizations — with commit messages disguised as "fix: resolve lint warnings", making them nearly impossible to detect in code review.
