Miasma supply-chain malware activity
Malware Activity
Summary
Hide ▲
Show ▼
The Miasma malware activity is enabling supply-chain compromise by stealing build environment and cloud credentials, then using them to poison legitimate packages and infect downstream developers. The framework’s self-propagating design can turn one compromised developer machine into repeated infections across npm, PyPI, and RubyGems ecosystems. Its reuse of GitHub for control and abuse of package publishing paths raises the risk of rapid spread and harder-to-block follow-on attacks.
Related Happenings
AsyncAPI malicious npm package supply-chain malware
Malware Activity
H score21
First: 15.07.2026 18:37
Last: 15.07.2026 18:37
Sources 1
About this happening:
Malicious AsyncAPI npm releases pushed a remote access trojan and info-stealing payload into packages with more than 2.25 million weekly downloads, putting downstr...
AsyncAPI malicious npm package supply-chain malware
Malware ActivityAbout this happening: Malicious AsyncAPI npm releases pushed a remote access trojan and info-stealing payload into packages with more than 2.25 million weekly downloads, putting downstr...
AsyncAPI repositories and npm publishing workflow hit by network compromise
Incident
H score27
First: 15.07.2026 12:16
Last: 15.07.2026 12:16
Sources 1
About this happening:
The AsyncAPI npm publishing pipeline was compromised in a July 14 supply-chain attack that used the project’s normal GitHub Actions release path to publish trojani...
AsyncAPI repositories and npm publishing workflow hit by network compromise
IncidentAbout this happening: The AsyncAPI npm publishing pipeline was compromised in a July 14 supply-chain attack that used the project’s normal GitHub Actions release path to publish trojani...
Single organization's private GitHub repository cloned after confirmed access
Data Leak
H score12
First: 09.07.2026 21:38
Last: 09.07.2026 21:38
Sources 1
About this happening:
Confirmed access to a private GitHub repository belonging to one organization marks a concrete data exposure and raises the risk of source-code or internal-content...
Single organization's private GitHub repository cloned after confirmed access
Data LeakAbout this happening: Confirmed access to a private GitHub repository belonging to one organization marks a concrete data exposure and raises the risk of source-code or internal-content...
GitHub API enumeration campaign targeting corporate organizations
Campaign
H score17
First: 09.07.2026 21:38
Last: 09.07.2026 21:38
Sources 1
About this happening:
A GitHub API reconnaissance campaign is systematically mapping corporate organizations, repositories, and user accounts across multiple companies, expanding the risk of fo...
GitHub API enumeration campaign targeting corporate organizations
CampaignAbout this happening: A GitHub API reconnaissance campaign is systematically mapping corporate organizations, repositories, and user accounts across multiple companies, expanding the risk of fo...
GitHub npm version 12 hardens installs and token management
Security Tool/Service
H score11
First: 09.07.2026 19:49
Last: 09.07.2026 19:49
Sources 1
About this happening:
GitHub released npm version 12, making install-time scripts opt-in by default and tightening package publishing controls to reduce supply-chain risk. The update al...
GitHub npm version 12 hardens installs and token management
Security Tool/ServiceAbout this happening: GitHub released npm version 12, making install-time scripts opt-in by default and tightening package publishing controls to reduce supply-chain risk. The update al...
Timeline
-
10.06.2026 23:27 2 articles · 1mo ago
SafeDep reports Miasma source code leak on GitHub
Initial DisclosureSafeDep reported that the Miasma credential-stealing framework was leaked on GitHub via numerous compromised developer accounts, with the source posted in a repository named "Miasma-Open-Source-Release." Analysis of the leaked code shows Miasma uses GitHub as its control channel without separate C2 infrastructure, steals cloud and CI/CD credentials, compromises npm, PyPI, RubyGems, GitHub repositories, Actions workflows, and JFrog Artifactory instances, and can move laterally through SSH and AWS Systems Manager (SSM) while poisoning AI coding tools such as Claude, Gemini, Cursor, Copilot, Kiro, and Cline.
Show sources
- The ‘Miasma’ worm source code briefly leaked on GitHub — www.bleepingcomputer.com — 10.06.2026 23:27
- The ‘Miasma’ worm source code briefly leaked on GitHub — www.bleepingcomputer.com — 10.06.2026 23:27