[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f5_zmnzRYSse07FZ7a6MrXd7NfuQFIzda1t4QYpifDtk":3},{"article":4,"iocs":48,"watch_terms":56,"solutions":57,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":25,"category":26,"article_tags":30},"8af6e6af-781c-407a-936e-18d85cfab5cc","Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack","miasma-malware-targets-npm-packages-and-github-actions-in-supply-chain-attack-a28186","Cybersecurity researchers have flagged yet another evolution of the supply chain attack linked to the Mini Shai-Hulud, Miasma, and Hades malware family that has compromised a new set of npm packages, even as it has propagated to the Go ecosystem. \"The latest activity includes malicious npm releases affecting LeoPlatform and RStreams packages, GitHub Actions workflow abuse, and a related Go","A new wave of supply chain attacks linked to the Miasma malware family has compromised npm packages and GitHub Actions, and has also spread to the Go ecosystem. The attackers aim to steal developer credentials by exploiting compromised accounts and using malicious code within package installations and GitHub workflows. The malware employs tactics like registry poisoning, secret exfiltration, and GitHub dead-drop infrastructure to spread and harvest sensitive information.","Miasma malware targets npm packages and GitHub Actions, spreading to Go ecosystem.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fmiasma-malware-targets-npm-packages-and.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEhatZ2Vkvxd086INLXiuhbRJrli5Ao9hoNajbVq-Xr0HVAS70cCzhRBfM78KEusnBPI1sXyAK5tYrKt55U5mTIXCQDAmBzY2e860qtXo4YAlvAnVWHDV3DddKUML1q1g71h97Ke1i-714gv5SaVW9lmaFNtRda5XP1kc20urtc-HzlX5JXwkQv0g_-1VwC3\u002Fs1600\u002FMiasma.jpg","2026-06-26T11:05:45+00:00","2026-06-26T12:00:23.333441+00:00",9,[17,20,23],{"name":18,"type":19},"npm","product",{"name":21,"type":22},"GitHub Actions","technology",{"name":24,"type":19},"Go","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":25,"icon":27,"name":28,"slug":29},null,"Supply Chain","supply-chain",[31,33,38,43],{"category":32},{"id":25,"icon":27,"name":28,"slug":29},{"category":34},{"id":35,"icon":27,"name":36,"slug":37},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":39},{"id":40,"icon":27,"name":41,"slug":42},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":44},{"id":45,"icon":27,"name":46,"slug":47},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[49,53],{"type":50,"value":51,"context":52},"url","https:\u002F\u002Fgithub.com\u002Fcodfish\u002Fsemantic-release-action","Compromised GitHub Action repository used for dead-drop resolver.",{"type":50,"value":54,"context":55},"https:\u002F\u002Fgithub.com\u002Fsearch?q=description%3D%22Alright%20Lets%20See%20If%20This%20Works.%22","Public GitHub repository used for uploading stolen secrets.",[18,24],{"controls":58,"vendors":144},[59,88,117],{"slug":60,"name":61,"problem":62,"products":63},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",[64,72,80],{"vendor_slug":65,"vendor_name":66,"vendor_logo":67,"product_slug":68,"product_name":69,"url":70,"description":71},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"sailpoint","SailPoint","\u002Fvendor-logos\u002Fsailpoint.png","human-fabric","SailPoint Human Fabric","https:\u002F\u002Fwww.sailpoint.com\u002Fproducts\u002Fhuman-fabric","Identity governance platform, the successor to Identity Security Cloud: lifecycle management, access requests and continuous access reviews.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"slug":89,"name":90,"problem":91,"products":92},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[93,101,109],{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"palo-alto-networks","Palo Alto Networks","\u002Fvendor-logos\u002Fpalo-alto-networks.png","idira-secrets-management","Idira Secrets Management","https:\u002F\u002Fwww.paloaltonetworks.com\u002Fidira\u002Fmachine\u002Fsecrets-management","Secrets management for applications, scripts and pipelines, from the former CyberArk portfolio.",{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"slug":118,"name":119,"problem":120,"products":121},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[122,128,136],{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":123,"product_name":124,"url":126,"description":127},"socket","Socket","\u002Fvendor-logos\u002Fsocket.png","https:\u002F\u002Fsocket.dev\u002F","Detects and blocks malicious and risky packages in npm, PyPI and other ecosystems.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":132,"product_name":133,"url":134,"description":135},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",{"vendor_slug":137,"vendor_name":138,"vendor_logo":139,"product_slug":140,"product_name":141,"url":142,"description":143},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",[145],{"slug":123,"name":124,"logo_path":125,"roles":146},[147],"reported_by",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":164},"miasma-malware-poisons-npm-and-github-actions-in-developer-supply-chain-attack","Miasma Malware Poisons npm and GitHub Actions in Developer Supply Chain Attack","The Miasma campaign demonstrates how attackers can weaponize trusted developer ecosystems — npm, GitHub Actions, and Go modules — to silently inject malicious code into software build pipelines. By compromising developer accounts and poisoning package registries, attackers gain access to downstream environments at scale without ever directly targeting end organizations. The use of GitHub as 'dead-drop' infrastructure makes detection harder because traffic blends in with legitimate developer activity. This matters because a single compromised package or workflow can cascade across thousands of projects and organizations, exfiltrating secrets like API keys, tokens, and credentials during routine CI\u002FCD operations.",[153,154,155,156,157,158,159,160,161,162,163],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-218: Secure Software Development Framework (SSDF) – PW.4 (Reuse Existing, Well-Secured Software)","NIST CSF: ID.SC-3 (Suppliers and third-party partners are identified)","NIST CSF: DE.CM-3 (Personnel activity is monitored)","SLSA Supply Chain Security Framework – Level 2\u002F3 provenance requirements","OpenSSF Scorecard – Dependency Pinning and CI\u002FCD Best Practices","GDPR Article 32: Security of processing (where developer credential theft leads to data breach exposure)",{}]