discovered 2026-06-03
IronWorm trojanized npm package published from compromised `asteroiddao` account.