Loading malware…
Miasma is a self-propagating, credential-stealing malware family and modular framework associated with TeamPCP, also tracked as UNC6780. It is a variant of Mini Shai-Hulud that spreads through compromised software packages in the npm and PyPI ecosystems. Its principal targets are developer workstations, development servers, CI/CD pipelines, and build environments. Public availability of related source code has enabled reuse, so the family’s presence alone does not establish attribution to a particular operator.
Miasma harvests developer and cloud authentication material, including package-publishing tokens, source-code access tokens, API keys, SSH private keys, environment variables, and cloud configuration data. Stolen publishing credentials support further propagation through malicious package releases. The malware also poisons configuration files used by AI coding tools, including Claude Code, Gemini CLI, and Cursor, to maintain execution. JavaScript obfuscation, encrypted payload stages, and misleading headers intended to influence AI-assisted code review support defense evasion.
A cross-platform modular runtime deployed in the July 2026 AsyncAPI npm compromise supported Windows, macOS, and Linux. Its loaders executed when affected packages were imported rather than through installation hooks, bypassing protections limited to disabling install scripts. The loaders retrieved an encrypted runtime through IPFS and launched it in a detached Node.js process. Runtime functionality included remote shell execution, directory listing, file transfer, proxying, and data exfiltration. Persistence used Windows user logon startup, Linux user services, and macOS shell-profile modifications. Decentralized discovery and fallback channels included Nostr, Ethereum, BitTorrent DHT, libp2p, and IPFS. Persistence and command-and-control were active in the analyzed build, while implemented credential-harvesting and propagation modules were disabled; those capabilities were therefore not evidence of active credential theft or self-propagation in that deployment.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
5 distinct threat actors Mallory has associated with this family across public reporting. Open in Mallory to see the full evidence chain and overlapping campaigns.
A July FBI advisory (PDF) identified TeamPCP malware including CanisterWorm, SANDCLOCK, Mini Shai-Hulud and Miasma.
The GitHub fingerprint the attackers left behind – a repository description reading “Alright Lets See If This Works” turned up on over 320 infected repositories before researchers began pulling the thread. That string is not something random. In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
The GitHub fingerprint the attackers left behind – a repository description reading “Alright Lets See If This Works” turned up on over 320 infected repositories before researchers began pulling the thread. That string is not something random. In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
An infrastructure provider's networks have been breached and they were dealing with the Miasma worm. That worm, as it turns out, is pretty hard to catch and delete because it is self-spreading through IDE configuration settings and through AI assisted environments.
An infrastructure provider's networks have been breached and they were dealing with the Miasma worm. That worm, as it turns out, is pretty hard to catch and delete because it is self-spreading through IDE configuration settings and through AI assisted environments.
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Les identifiants ciblés comprennent clés IAM, jetons OIDC, jetons Entra ID, comptes de service GCP, PATs et clés API; la liste inclut T1078 — Valid Accounts.
Attackers target a commonly used software dependency and hijack its latest version to inject malicious code to be executed in victim environments.
Attackers then pushed poisoned commits and let the project’s own trusted publishing path release the malware under a valid npm identity.
« Ciblage de pipelines CI/CD par des malwares de type infostealer (ex : Miasma, TeamPCP LiteLLM) »; la liste inclut T1195.002.
The bootstrapper writes an obfuscated JavaScript payload named _index.js to the user home directory and invokes it using Bun.
The malware does not rely on the usual install scripts... Instead it springs to life when any application or build tool loads the poisoned module.
Les identifiants ciblés comprennent clés IAM, jetons OIDC, jetons Entra ID, comptes de service GCP, PATs et clés API; la liste inclut T1078 — Valid Accounts.
Persistence and command channels were already active, so a later remote update could flip those switches without another package release.
Les identifiants ciblés comprennent clés IAM, jetons OIDC, jetons Entra ID, comptes de service GCP, PATs et clés API; la liste inclut T1078 — Valid Accounts.
Persistence and command channels were already active, so a later remote update could flip those switches without another package release.
The bootstrapper writes an obfuscated JavaScript payload named _index.js. The Miasma lineage uses JavaScript-based obfuscation engines to make behavioral sandboxing and traditional signature-based detection difficult.
Active credential-stealing campaigns, such as Mini Shai-Hulud, Miasma, and Hades, embedding fake headers specifically engineered to fool AI-assisted review tools into marking code as benign.
Les identifiants ciblés comprennent clés IAM, jetons OIDC, jetons Entra ID, comptes de service GCP, PATs et clés API; la liste inclut T1078 — Valid Accounts.
The malware does not rely on the usual install scripts... Instead it springs to life when any application or build tool loads the poisoned module.
including direct extraction from runner process memory via /proc/*/mem
Les cibles incluent des jetons OIDC AWS SSO, jetons Entra ID et refresh tokens, jetons GCP, GitHub App/OAuth/PAT, jetons GitLab Runner et jetons OAuth d’outils IA.
Les artefacts ciblés comprennent ~/.aws/credentials, fichiers Azure accessTokens.json et caches MSAL, bases GCP credentials.db/access_tokens.db, fichiers GitHub/GitLab de configuration, ainsi que des fichiers .env et credentials.json contenant des clés API.
It looks for more than one hundred environment variable names spanning source control, package registries, major cloud providers, container platforms, secret managers, and popular AI services.
On disk the framework searches familiar files such as .npmrc, AWS credentials, kubeconfig, SSH private keys, Vault tokens, .netrc, Docker config, and Google service account JSON.
The report warns that these campaigns exploit “transitive trust” in software supply chains, turning maintainer accounts, CI/CD tokens and cloud credentials into high-value targets
When a GitHub token is found it can list reachable repositories and CI context through public APIs.
extracting sensitive data, including but not limited to cloud access tokens, SSH keys, and Kubernetes secrets
The second stage delivers a modular runtime called Miasma. That framework can talk to remote servers... Primary control servers sat at a single IP on ports 8080, 8081, and 8091, with fallback discovery over several decentralized networks.
When triggered, the script performs basic network checks and retrieves the Bun JavaScript runtime binary, saving it under ~/.bun.
Miasma also used an Ethereum contract as a fallback source for command-and-control configuration, including alternative endpoints, relay information, and bootstrap data.
Stolen credentials are once again exfiltrated to attacker-controlled GitHub repositories.
The FBI confirmed two GitHub repository names used for exfiltration: tpcp-docs and docs-tpcp.
Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files.
153 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
104 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.