Loading malware…
Miasma is a developer-targeting supply-chain malware family associated with 2026 compromises in open-source package ecosystems, especially npm. It is widely described as a derivative or variant of Mini Shai-Hulud and has been linked by multiple researchers to TeamPCP activity, although some individual incidents that reused Miasma branding or technical motifs were explicitly assessed as possible false-flag operations rather than confirmed TeamPCP intrusions. Miasma has appeared both as a self-propagating worm and as a modular remote-access framework delivered through trusted software release paths.
In npm-focused campaigns, Miasma spread through compromised packages and abused nonstandard execution paths to evade common defenses. Documented delivery and execution methods include install-time abuse of native build configuration files instead of package.json lifecycle hooks, as well as import-time loaders embedded directly in legitimate package code so that protections such as ignoring install scripts do not prevent execution. In major supply-chain incidents, attackers abused legitimate CI/CD and trusted publishing workflows to release poisoned packages with valid provenance, demonstrating that signed attestations alone do not guarantee package safety.
Miasma’s capabilities center on credential theft, persistence, command-and-control, and propagation. Reported targeting includes developer and cloud secrets such as source-control tokens, package-publishing credentials, cloud-provider credentials, container and orchestration secrets, SSH material, password-store data, browser data, cryptocurrency wallets, and CI/CD secrets, including extraction from runner process memory. Some analyzed builds contained dormant theft modules while maintaining active persistence and remote-control channels for later activation. The malware has also been observed enumerating repositories and CI context when suitable tokens are available.
Persistence is a defining feature. Miasma has been documented implanting hooks in IDE and AI coding-assistant configuration files so code re-executes when developers open projects or start AI-assisted coding sessions. Reported targets include configuration and rules files for tools such as VS Code, Claude Code, Cursor, Gemini CLI, and GitHub Copilot. This tradecraft supports both durable access and poisoning of AI-assisted development workflows.
As a worm, Miasma can propagate by stealing publishing tokens and republishing infected package versions through legitimate maintainer access. Some variants also forged or abused provenance mechanisms so reinfected packages appeared trustworthy. Other observed builds behaved primarily as a RAT or modular backdoor rather than confirmed autonomous worms, but still retained infrastructure for persistence, remote tasking, file handling, updates, and decentralized fallback communications.
Miasma has used resilient communications designs, including conventional HTTP-based command-and-control and decentralized fallback channels such as IPFS, Ethereum-based configuration storage, Nostr, BitTorrent DHT, libp2p, GitHub dead drops, and mDNS-related mechanisms. Several reports also describe anti-analysis or defense-evasion behavior, including obfuscation, environment checks, and attempts to avoid reliance on obvious attacker-controlled infrastructure.
Targeting has focused on developers, CI/CD runners, software publishers, and organizations that depend on compromised packages, with downstream risk extending into containers and production services when malicious dependencies are imported or executed. Industries are not narrowly constrained because the malware exploits transitive trust in software ecosystems, allowing compromise to cascade across unrelated organizations through shared dependencies and developer credentials.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
These include CanisterWorm, Sandclock, the self-replicating worm Mini Shai-Hulud, which targets open source repositories, and Miasma, a variant of Mini Shai-Hulud.
The GitHub fingerprint the attackers left behind – a repository description reading “Alright Lets See If This Works” turned up on over 320 infected repositories before researchers began pulling the thread. That string is not something random. In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
The GitHub fingerprint the attackers left behind – a repository description reading “Alright Lets See If This Works” turned up on over 320 infected repositories before researchers began pulling the thread. That string is not something random. In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
An infrastructure provider's networks have been breached and they were dealing with the Miasma worm. That worm, as it turns out, is pretty hard to catch and delete because it is self-spreading through IDE configuration settings and through AI assisted environments.
An infrastructure provider's networks have been breached and they were dealing with the Miasma worm. That worm, as it turns out, is pretty hard to catch and delete because it is self-spreading through IDE configuration settings and through AI assisted environments.
26 distinct techniques documented for this family, organized by ATT&CK tactic.
propagates automatically by forging provenance attestations so reinfected packages appear legitimate.
TeamPCP actors have conducted large-scale software supply chain compromises by targeting widely used developers and security tools, gaining access to victim environments and extracting sensitive data
For each one it finds, it injects a hook command which helps the malware stay persistent... every time the developer starts an AI coding session, the malware runs silently and automatically.
propagates automatically by forging provenance attestations so reinfected packages appear legitimate.
The attack began with a vulnerable GitHub Actions configuration that allowed untrusted pull request content to interact with a privileged workflow context. This gave the attacker a path to obtain or abuse an AsyncAPI automation identity and make unauthorized repository changes.
propagates automatically by forging provenance attestations so reinfected packages appear legitimate.
executes an obfuscated second-stage payload identified as Math_Symbol.js or Math_Init.js
propagates automatically by forging provenance attestations so reinfected packages appear legitimate.
including direct extraction from runner process memory via /proc/*/mem
harvests AWS, GCP, and Azure credentials | harvests AWS, GCP, and Azure credentials, GitHub Actions secrets
On disk the framework searches familiar files such as .npmrc, AWS credentials, kubeconfig, SSH private keys, Vault tokens, .netrc, Docker config, and Google service account JSON.
It looks for more than one hundred environment variable names spanning source control, package registries, major cloud providers, container platforms, secret managers, and popular AI services.
The second stage delivers a modular runtime called Miasma. That framework can talk to remote servers... Primary control servers sat at a single IP on ports 8080, 8081, and 8091, with fallback discovery over several decentralized networks.
That child fetched an encrypted second stage from IPFS, wrote sync.js into an OS-specific NodeJS folder, and unlocked the Miasma runtime.
153 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
93 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A suspected copycat Shai-Hulud-derived campaign that compromised package publishers, abused trusted publishing and provenance, generated unique payloads per infection, and spread through npm packages.
A newer variant of Shai-Hulud identified targeting developers.
Named malicious npm package campaign/family referenced as another example of malware that reached the npm registry despite scanning controls.
Referenced only as a comparison point for worm-like self-propagating malware behavior.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.