Loading malware…
Miasma is a developer-targeting malware family associated with software supply-chain attacks, especially against npm packages and related CI/CD environments. It has been observed both as a self-propagating worm and as a modular Node.js remote-access payload delivered through compromised legitimate packages. Activity linked to Miasma overlaps with the broader Shai-Hulud and Mini Shai-Hulud ecosystem, and some reporting links derivative campaigns to the financially motivated TeamPCP cluster after publication of Mini Shai-Hulud source code. Attribution is not uniform across all incidents, and some intrusions reused Miasma branding as a likely false flag.
Miasma has been distributed through trusted software release paths, including compromised npm packages published via legitimate maintainer or CI/CD workflows. Observed execution methods include install-time abuse of build-related files to trigger code execution without standard lifecycle scripts, preinstall-based loaders, and import-time execution embedded directly in package source so that protections focused on install scripts are bypassed. In several incidents, first-stage loaders retrieved encrypted second-stage payloads from decentralized storage and launched a large modular runtime.
The malware’s core behavior centers on persistent remote access, credential theft, and propagation. Documented capabilities include command-and-control communications, persistence across developer endpoints, modular task loading, file operations, and dormant or active credential-harvesting modules. Miasma has targeted developer and cloud secrets such as source-control tokens, package-registry credentials, cloud-provider credentials, container and Kubernetes secrets, SSH material, browser data, cryptocurrency wallets, database credentials, and CI/CD secrets. Some variants also scrape secrets from GitHub Actions runner memory and enumerate repositories or publishing rights using stolen tokens.
A notable characteristic of Miasma and closely related variants is propagation through developer trust relationships. Self-spreading forms have republished poisoned packages using stolen registry credentials, forged provenance or abused legitimate trusted-publishing workflows, and attempted to spread across ecosystems including npm and potentially other language registries. The malware has also been observed modifying AI coding-assistant configuration and rules files to establish persistence and influence future developer sessions, extending compromise beyond the initial package infection.
Targeting is concentrated on developer workstations, build runners, containers, and software release infrastructure rather than traditional enterprise endpoints. Organizations at greatest risk include software vendors, open-source maintainers, and enterprises with automated dependency restoration or privileged CI/CD pipelines. In AsyncAPI-related intrusions, Miasma-associated payloads were delivered through official packages after abuse of misconfigured GitHub Actions workflows, demonstrating that valid provenance and trusted publishing do not guarantee benign code when upstream repositories or automation are compromised.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The financially motivated group TeamPCP was linked to some of the most significant activity, including the self-propagating “Mini Shai-Hulud” worm, which continued to spawn derivative campaigns, dubbed Miasma and Hades, after its source code was published to GitHub in May.
The GitHub fingerprint the attackers left behind – a repository description reading “Alright Lets See If This Works” turned up on over 320 infected repositories before researchers began pulling the thread. That string is not something random. In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
The GitHub fingerprint the attackers left behind – a repository description reading “Alright Lets See If This Works” turned up on over 320 infected repositories before researchers began pulling the thread. That string is not something random. In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
An infrastructure provider's networks have been breached and they were dealing with the Miasma worm. That worm, as it turns out, is pretty hard to catch and delete because it is self-spreading through IDE configuration settings and through AI assisted environments.
An infrastructure provider's networks have been breached and they were dealing with the Miasma worm. That worm, as it turns out, is pretty hard to catch and delete because it is self-spreading through IDE configuration settings and through AI assisted environments.
25 distinct techniques documented for this family, organized by ATT&CK tactic.
propagates automatically by forging provenance attestations so reinfected packages appear legitimate.
Attackers published malicious versions of legitimate npm packages through a compromised GitHub maintainer account and additional publishing accounts reached using stolen credentials, including accounts with access to packages in the @servicetitan namespace.
For each one it finds, it injects a hook command which helps the malware stay persistent... every time the developer starts an AI coding session, the malware runs silently and automatically.
propagates automatically by forging provenance attestations so reinfected packages appear legitimate.
The attack began with a vulnerable GitHub Actions configuration that allowed untrusted pull request content to interact with a privileged workflow context. This gave the attacker a path to obtain or abuse an AsyncAPI automation identity and make unauthorized repository changes.
propagates automatically by forging provenance attestations so reinfected packages appear legitimate.
executes an obfuscated second-stage payload identified as Math_Symbol.js or Math_Init.js
propagates automatically by forging provenance attestations so reinfected packages appear legitimate.
including direct extraction from runner process memory via /proc/*/mem
harvests AWS, GCP, and Azure credentials | harvests AWS, GCP, and Azure credentials, GitHub Actions secrets
On disk the framework searches familiar files such as .npmrc, AWS credentials, kubeconfig, SSH private keys, Vault tokens, .netrc, Docker config, and Google service account JSON.
It looks for more than one hundred environment variable names spanning source control, package registries, major cloud providers, container platforms, secret managers, and popular AI services.
The second stage delivers a modular runtime called Miasma. That framework can talk to remote servers... Primary control servers sat at a single IP on ports 8080, 8081, and 8091, with fallback discovery over several decentralized networks.
That child fetched an encrypted second stage from IPFS, wrote sync.js into an OS-specific NodeJS folder, and unlocked the Miasma runtime.
151 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
90 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A newer variant of Shai-Hulud identified targeting developers.
Named malicious npm package campaign/family referenced as another example of malware that reached the npm registry despite scanning controls.
Referenced only as a comparison point for worm-like self-propagating malware behavior.
A modular second-stage runtime delivered through compromised AsyncAPI npm packages. It establishes persistence, communicates with remote servers, can fetch updates/modules, and contains credential theft functionality targeting developer, CI/CD, cloud, container, secret-management, and AI-service credentials.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.