Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack

The Miasma campaign demonstrates how attackers can weaponize trusted developer ecosystems — npm, GitHub Actions, and Go modules — to silently inject malicious code into software build pipelines. By compromising developer accounts and poisoning package registries, attackers gain access to downstream environments at scale without ever directly targeting end organizations. The use of GitHub as 'dead-drop' infrastructure makes detection harder because traffic blends in with legitimate developer activity. This matters because a single compromised package or workflow can cascade across thousands of projects and organizations, exfiltrating secrets like API keys, tokens, and credentials during routine CI/CD operations.