Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Miasma software supply chain campaign expands to new PyPI wave

Campaign
First reported
Last updated
Happening score
H score 29
1 unique sources, 1 articles

Summary

Hide ▲

The Miasma supply-chain campaign has expanded into a new PyPI wave, increasing the risk that developers and downstream users will ingest information-stealing malware through trusted open-source packages. The latest cluster adds 23 packages and shows that the operators are changing delivery methods rather than relying on a single implant format.

Cases

Miasma supply-chain compromise disrupts Microsoft GitHub repositories (3)

Related Happenings

@Injectivelabs/[email protected] wallet-stealing package

Malware Activity
H score30 First: 10.07.2026 20:29 Last: 10.07.2026 20:29 Sources 1

About this happening: The malicious @injectivelabs/[email protected] package is a wallet-stealing malware activity that can expose private keys and mnemonic seed phrases when library functions...

Open Happening

Injective Labs SDK project GitHub repository hit by network compromise

Incident
H score21 First: 09.07.2026 23:10 Last: 09.07.2026 23:10 Sources 1

About this happening: The Injective Labs SDK project suffered a GitHub repository compromise that let attackers publish a malicious @injectivelabs/sdk-ts v1.20.21 package, putting developer...

Open Happening

North Korean Contagious Interview PolinRider supply-chain campaign

Campaign
H score51 First: 04.07.2026 14:17 Last: 04.07.2026 14:17 Sources 1

About this happening: The Contagious Interview / PolinRider campaign is still active, with 108 unique packages and browser extensions published across npm, Packagist, Go, and Google Chrome....

Open Happening

Sapphire Sleet Mastra npm supply-chain campaign

Campaign
H score42 First: 20.06.2026 17:09 Last: 20.06.2026 17:09 Sources 1

About this happening: The Mastra AI supply-chain campaign was attributed to Sapphire Sleet / BlueNoroff after Microsoft said the operation compromised the npm maintainer account "ehindero...

Open Happening

Mastra @mastra/* npm packages hit by network compromise

Incident
H score47 First: 17.06.2026 10:38 Last: 17.06.2026 10:38 Sources 1

About this happening: Mastra @mastra/* npm packages were compromised in a software supply chain attack that spread through the namespace on 2026-06-17. Microsoft now attributes the acti...

Latest development: 20.06.2026 17:09

Microsoft attributed the Mastra AI supply chain attack to Sapphire Sleet, also known as BlueNoroff, and said the attackers compromised the npm maintainer account ehindero, which had publishing privileges across the Mastra package environment. The June 19 update said more than 140 packages in the @mastra scope were modified to inject easy-day-js.

Open Happening

Timeline

  1. 09.06.2026 19:34 2 articles · 1mo ago

    Miasma supply-chain campaign expands to 23 more PyPI packages

    Campaign Scope Update

    Microsoft temporarily removed some GitHub repositories after 73 open-source projects were compromised to inject an information stealer, while the broader Miasma, Mini Shai-Hulud, and Hades activity also spread into a new PyPI wave that added 23 packages. The campaign uses multiple delivery methods, including executable .pth startup hooks, trojanized .abi3.so extensions, and a loader that searches sys.path for _index.js, and the payloads target developer workstations and CI/CD environments to harvest secrets and exfiltrate them to a public GitHub repository.

    Show sources
    Open in new tab