Loading story…
Researchers reported that the Miasma malware family is expanding from software supply-chain compromise into AI-assisted development environments, using trusted tooling to gain persistence, steal credentials, and sabotage systems. Tenable linked the campaign to Mini Shai-Hulud and a Miasma variant that modifies AI coding assistant configuration and rules files, adding SessionStart hooks and prompt-injection content so malicious actions run automatically when developers launch tools such as Claude Code, Gemini CLI, GitHub Copilot, Cursor, ChatGPT Codex, Cline, and Aider. WIRED, citing CrowdStrike research, said the malware is built to burrow into AI infrastructure, exfiltrate sensitive data, deepen access, and in some cases trigger a destructive "death switch" that locks out users while wiping or damaging files.
Semgrep separately detailed a related supply-chain intrusion in which an attacker gained push access to the asyncapi/generator repository’s next branch and used the project’s legitimate GitHub Actions release workflow to publish malicious npm packages with valid SLSA provenance through npm’s trusted-publisher integration. Affected packages included @asyncapi/generator, @asyncapi/generator-helpers, @asyncapi/generator-components, and later @asyncapi/specs; they contained an obfuscated dropper that executed on require(), launched a hidden Node.js process, fetched a second-stage payload from IPFS, and deployed Miasma v3. The malware sought GitHub, npm, PyPI, AWS, Kubernetes, SSH, browser, and macOS Keychain secrets, underscoring how attackers are abusing both package ecosystems and AI agent harness files as high-trust, low-visibility footholds in developer environments.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
4 events from the most recent confirmed update back to the earliest known activity.
Research reported on July 21, 2026 described the Mini Shai-Hulud campaign and its Miasma variant as targeting developer environments by modifying AI coding assistant configuration and rules files for persistence and automatic malicious execution. The reporting said the malware sought credentials, deeper access, data exfiltration, and in some cases destructive effects including a lockout-and-wipe 'death switch.'
On July 14, 2026, an attacker with push access to the asyncapi/generator repository’s next branch used the project’s legitimate GitHub Actions release workflow and npm trusted-publisher integration to publish malicious packages with valid SLSA provenance. The compromised packages included @asyncapi/generator, @asyncapi/generator-helpers, @asyncapi/generator-components, and later @asyncapi/specs, carrying an obfuscated dropper that fetched and deployed Miasma v3.
On June 4, 2026, Semgrep reported that the self-propagating Miasma v2 npm malware had compromised 57 packages across more than 286 malicious versions. The report said the worm used a malicious binding.gyp file to execute during npm install without lifecycle scripts, and detailed credential theft, AI-assistant persistence, forged provenance, and published IOCs and affected package lists.
On May 18, 2026, Semgrep reported a supply-chain compromise of an npm maintainer that led to malicious dependencies being injected into widely used packages including the @antv/* namespace, timeago.js, and size-sensor. The exposure window enabled further spread across hundreds of npm ecosystem packages, consistent with renewed Mini Shai-Hulud worm activity.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
5 references tracked. Mallory keeps watching after this page renders.
tenable.com
Open sourcewired.com
Open sourcesemgrep.dev
Open sourcesemgrep.dev
Open sourcesemgrep.dev
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Multiple `@asyncapi` npm packages were compromised in a software supply-chain attack that inserted a multi-stage malware loader into widely used developer tooling with roughly 2 million weekly downloads. Reports identified malicious versions including `@asyncapi/generator-helpers@1.1.1`, `@asyncapi/generator-components@0.7.1`, `@asyncapi/generator@3.3.1`, and additional trojanized packages in the namespace, with one analysis counting five affected packages. The injected code was hidden in `src/utils.js` and triggered during normal `require()` or import execution rather than npm lifecycle hooks, spawning a detached Node.js child process that fetched an encrypted second-stage payload from IPFS and wrote it to disk as `sync.js` in user-specific directories across macOS, Linux, and Windows. Researchers said the second stage was a **Miasma** variant or related botnet framework that established persistence, beaconed to `85.137.53.71:8080`, and enabled remote shell access for arbitrary command execution. Analyses also described broader built-in capabilities for file operations, credential harvesting, evasion, propagation, mutation, and destructive actions, though some of those functions were reportedly disabled in the observed build. Security firms warned that developer workstations and CI environments using the affected packages may have been exposed, advised avoiding the malicious versions, upgrading once clean releases are available, inspecting systems for compromise, and rotating potentially exposed credentials; one report added that `@asyncapi/specs@6.11.2-alpha.1` remained directly downloadable even after removal from registry metadata.
Jul 24, 2026
GitHub disabled more than 70 Microsoft-owned repositories after detecting a suspected **Miasma** worm campaign that inserted malicious code into open source projects and disrupted dependent CI/CD workflows. Researchers said the incident began with a compromised contributor account pushing a malicious commit to `Azure/durabletask`, adding configuration files that could trigger remote code execution when developers opened the repository in IDEs or AI coding tools including **Claude Code**, **Gemini CLI**, and **Cursor**. Microsoft’s response was unusual because it shut down its own repositories rather than only removing the offending content, and GitHub reportedly disabled 73 repositories in rapid succession after automated detections fired. The activity appears tied to a broader supply-chain operation linked to earlier compromises of Microsoft’s `durabletask` PyPI package and to a newer campaign tracked by StepSecurity as **Hades**, which it describes as an evolution of Miasma. StepSecurity said the malware uses obfuscated Python import hooks to fetch additional payloads, scrape memory across Linux, macOS, and Windows, steal cloud and developer credentials, abuse GitHub Actions and OIDC/Sigstore workflows, move laterally over SSH/SCP, and backdoor IDE and AI assistant configuration files. The campaign also reportedly uses GitHub-based command-and-control and includes a token-monitoring component that can trigger a destructive wiper if a stolen GitHub token is revoked, underscoring the risk to software supply chains and AI-assisted development environments.
Jun 29, 2026
A large software supply-chain campaign dubbed **Mini Shai-Hulud** compromised more than 170 npm packages and at least two PyPI packages tied to projects including **TanStack, Mistral AI, OpenSearch, UiPath, Guardrails AI,** and others. Researchers and vendors attributed the activity to **TeamPCP**, saying the attackers abused GitHub Actions release workflows—especially `pull_request_target`, cache poisoning, and theft of short-lived **OIDC** material from runners—to publish trojanized packages with apparently legitimate **SLSA** provenance, Sigstore attestations, and trusted-publishing signatures. Reports variously counted between roughly 160 and 400+ malicious package versions, with some affected packages totaling hundreds of millions of downloads, and OpenSearch and Mistral both confirmed compromised releases while TanStack described a chained workflow attack on its publishing pipeline. The malware targeted developer workstations and CI/CD systems, stealing **npm**, **GitHub**, cloud, Kubernetes, Vault, SSH, Docker, and AI-tool credentials, then attempting worm-like propagation by republishing infected packages with stolen tokens or workflow-issued publish credentials. Investigators said the payload also established persistence through **VS Code** tasks, **Claude Code** hooks, and in some cases system services, while exfiltrating data through **Session**, GitHub dead drops, and other attacker infrastructure; some variants included extortion notes, dead-man-switch logic, and geofenced destructive behavior. Defenders were urged to treat hosts that installed affected versions as potentially fully compromised, remove persistence before revoking tokens where applicable, rotate all exposed secrets from clean systems, invalidate CI caches, audit lockfiles and publishing activity, and rebuild impacted environments from trusted sources.
Jul 12, 2026