发现针对 Web3 从业者的新型招聘诈骗，恶意软件伪装为 AI 面试工具
Related
SlowMist: A new Rust supply chain malware, IronWorm, is attacking the Web3 ecosystem via npm packages.
PANews reported on June 4th that, according to SlowMist monitoring, a new Rust supply chain malware campaign called IronWorm is attacking developer environments and the Web3 ecosystem through malicious npm packages. Potential attacks include credential theft, wallet seed phrase and password theft, GitHub repository tampering, malicious package distribution, CI/CD confidentiality leaks, Tor-based command control, and eBPF rootkit stealth. Security teams should audit backtracking commits, suspicious branches, unexpected build hooks, and commits using automated identities such as claude, dependabot, renovate, or github-actions in repositories.
SlowMist: Over 140 Mastra npm instances have been subjected to supply chain attacks, posing security risks.
According to Foresight News , SlowMist has detected a coordinated supply chain attack targeting over 140 npm packages. The affected packages automatically add a dependency on easy-day-js@^1.11.21 during installation. This dependency resolves to the malicious version easy-day-js@1.11.22, triggering attacker-controlled code via a hook during installation. Potential attacker behaviors include: executing code during installation, maintaining persistence on Windows/macOS/Linux, collecting browser history, inventorying cryptocurrency wallet extensions, exposing credentials or CI keys through subsequent actions, and data breaches. For any system with the affected version installed, treat it as potentially vulnerable: remove the malicious version and easy-day-js, delete node_modules and package cache, reinstall a known clean version (using a verified lock file), isolate the affected host, preserve logs, remove persistent traces, and rotate npm, GitHub, cloud services, SSH/Git, CI/CD, and wallet-related credentials where possible.
Hermes v0.16.0 Official Version: Desktop version supports remote OAuth gateway and web configuration.
According to Beating, Nous Research has released the official version of its open-source AI agent framework, Hermes Agent v0.16.0 (v2026.6.5). Following the recent release of the desktop preview version, the new version officially pushes the Hermes framework into the productivity stage through remote gateway connectivity and web-based configuration. The core upgrade is the introduction of WebSocket-based remote gateway connectivity on the desktop, supporting secure verification via OAuth or username/password. Users can run the desktop graphical interface on lightweight laptops while hosting significant AI computing power and API keys on remote servers or in home labs. The web-based control panel has also been upgraded to a full-featured backend management system. Users no longer need to manually edit configuration files via SSH login to the server; they can directly enable or disable the MCP tool directory, bind instant messaging channels such as Telegram, Discord, and Slack, manage credentials and webhooks, and adjust system memory within their browser. Furthermore, to serve Chinese developers, the new version provides complete Simplified Chinese localization support for the desktop version. In terms of core logic and ease of use, the default skill set has been streamlined, removing redundant and outdated tools to reduce the context burden on the model, and incorporating NVIDIA/skills trusted Taps. The new version also introduces a fuzzy search model selector that works across desktop, web, TUI, and CLI interfaces, and introduces the /undo command that supports rolling back N rounds of dialogue and re-editing, further improving the fault tolerance of human-computer collaboration.
Web3 asset management platform XEFFY has raised $20 million in funding, which will be used to expand its Vault and RWA infrastructure.
According to Mars Finance, as reported by The Block, Web3 asset management platform XEFFY has announced the completion of a $20 million funding round, including a $5 million angel round and a $15 million private round supported by early strategic investors. The funds will be used to develop its Vault management platform, expand its on-chain Real-World Asset (RWA) infrastructure, and support early-stage RWA projects through the XEFFY Fund to expand its global ecosystem. The platform combines a market-neutral Vault strategy with dedicated on-chain RWA infrastructure built for retail and institutional users. Currently, the tokenized RWA market is projected to exceed $30 billion by 2025, with institutions such as BlackRock and Fidelity already deploying related products. The XEFFY platform has approximately 200,000 community members on X, Telegram, and Discord, and its Asia-Pacific Ambassador Program has approximately 200 contributors.
Influence360, a Web3 creator marketing platform, has launched, supporting global KOL reach and real conversion attribution.
BlockBeats reported on May 26th that Influence360, a Web3 creator marketing platform, officially launched. The platform focuses on AI-driven KOL marketing infrastructure, enabling projects to discover multilingual Web3 KOLs globally on platforms such as X, YouTube, TikTok, and Telegram, and to execute campaigns, track data, and attribute performance. According to reports, Influence360 offers features including AI optimization, smart contract escrow payments, and real-time performance tracking, aiming to solve long-standing problems in Web3 KOL marketing such as opaque payments, lack of data accumulation, and difficulty in quantifying conversion effects. The platform also provides a permission management system for Web3 agencies and MCNs, allowing agencies to accept orders on behalf of creators, manage pricing uniformly, and receive long-term revenue sharing through a referral mechanism. Dejan Horvat, co-founder and CEO of Influence360, stated that while Web3 KOL marketing currently involves significant budgets, the industry infrastructure remains rudimentary, often preventing teams from truly accumulating data and optimizing campaign efficiency. Influence360 aims to transform each marketing campaign into a sustainable accumulation of data assets. Meanwhile, Influence360 released its "2026 State of Web3 Influencer Marketing Report." Based on a survey of 143 Web3 KOLs from seven regions worldwide, the report shows that over half of the KOLs earn between $1,000 and $5,000 per collaboration, but only 35% of KOLs reported receiving full payment from all their collaborations, reflecting a significant trust issue within the industry. The report also points out that 97% of surveyed KOLs have collaborated repeatedly on the same projects. Most creators prioritize team transparency, investment background, and project credibility before accepting projects, but the industry currently lacks comprehensive marketing tools, reliable payment systems, and effective attribution mechanisms.
SlowMist: The GitHub and Grafana security incidents are likely related to a large-scale "mini sandworm" supply chain attack.
Mars Finance reported on May 20th that, according to SlowMist, several high-frequency npm packages, including AntV, Echarts-for-react, and the Python SDK durabletask, have recently been targeted by the Mini Shai-Hulud supply chain attack. SlowMist advises mitigation measures including: • Immediately rotate all publicly available GitHub, npm, PyPI, and cloud credentials; • Replace affected npm/PyPI packages with verified, secure versions, or freeze dependency versions; • Isolate potentially compromised systems and audit for credential theft or lateral movement; • Apply security patches to CI/CD pipelines and review artifacts after the intrusion. SlowMist also recommends: enabling real-time monitoring and alerts for suspicious token or key usage; implementing stricter dependency review policies and supply chain risk checks; training teams to verify package authenticity before installation; and monitoring the Dark Web or underground marketplaces for leaked credentials associated with the organization.