Miasma worm source code leaked on GitHub
The Miasma credential-stealing framework targeting open-source supply chains was deliberately leaked on GitHub, revealing autonomous propagation capabilities and a destructive dead-man switch.
Sourcebleepingcomputer.com — open the original
What to check
- Applies to
- Whether this concerns you is not assessed; the names the report mentions are listed below.
The Miasma attack framework, which evolved from the earlier Shai-Hulud worm, was deliberately leaked on GitHub through multiple compromised developer accounts. The malware operates as a self-propagating worm that infects developer machines, steals build environment and cloud credentials, and uses them to compromise legitimate repositories and packages. It publishes trojanized versions to infect downstream developers, creating a cascading supply-chain attack. Miasma has been linked to attacks on Red Hat npm packages and 73 Microsoft GitHub repositories.
Analysis of the leaked source code reveals sophisticated capabilities including credential harvesting from cloud providers, CI/CD systems, password managers, Kubernetes, and secret stores. The framework requires no command-and-control infrastructure, instead using GitHub itself for operations. It can compromise npm, PyPI, and RubyGems packages, GitHub repositories and Actions workflows, and JFrog Artifactory instances. The malware also features lateral movement via SSH and AWS Systems Manager, and can poison AI coding tool configurations including Claude, Gemini, Cursor, Copilot, Kiro, and Cline.
A notable feature is a destructive dead-man switch that monitors stolen GitHub tokens every minute and, if revoked, executes a recursive deletion command targeting the user's home and Documents folders. The malware employs a five-stage build pipeline generating unique payloads using AES-256-GCM encryption, randomized obfuscation, and three-layer encryption wrapping to evade signature-based detection. The leak is expected to accelerate supply-chain attacks as threat actors adopt and modify the code, similar to the pattern following the Shai-Hulud leak.
Mentioned in this report
Source reporting: https://www.bleepingcomputer.com/news/security/the-miasma-worm-source-code-briefly-leaked-on-github/
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the malware it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,433 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs