Miasma Malware Hijacks AI Coding Tool Configs and AsyncAPI npm Releases

Researchers reported that the Miasma malware family is expanding from software supply-chain compromise into AI-assisted development environments, using trusted tooling to gain persistence, steal credentials, and sabotage systems. Tenable linked the campaign to Mini Shai-Hulud and a Miasma variant that modifies AI coding assistant configuration and rules files, adding SessionStart hooks and prompt-injection content so malicious actions run automatically when developers launch tools such as Claude Code, Gemini CLI, GitHub Copilot, Cursor, ChatGPT Codex, Cline, and Aider. WIRED, citing CrowdStrike research, said the malware is built to burrow into AI infrastructure, exfiltrate sensitive data, deepen access, and in some cases trigger a destructive "death switch" that locks out users while wiping or damaging files.

Semgrep separately detailed a related supply-chain intrusion in which an attacker gained push access to the asyncapi/generator repository’s next branch and used the project’s legitimate GitHub Actions release workflow to publish malicious npm packages with valid SLSA provenance through npm’s trusted-publisher integration. Affected packages included @asyncapi/generator, @asyncapi/generator-helpers, @asyncapi/generator-components, and later @asyncapi/specs; they contained an obfuscated dropper that executed on require(), launched a hidden Node.js process, fetched a second-stage payload from IPFS, and deployed Miasma v3. The malware sought GitHub, npm, PyPI, AWS, Kubernetes, SSH, browser, and macOS Keychain secrets, underscoring how attackers are abusing both package ecosystems and AI agent harness files as high-trust, low-visibility footholds in developer environments.