[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIcf2P42lZBv4A-rbAb9LWk5T9mSzvWZtWm7608VTXd4":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":57},"9c4407d4-a316-43ca-b640-29ba57910924","miasma-malware-poisons-npm-and-github-actions-in-developer-supply-chain-attack","8af6e6af-781c-407a-936e-18d85cfab5cc","Miasma Malware Poisons npm and GitHub Actions in Developer Supply Chain Attack","The Miasma campaign demonstrates how attackers can weaponize trusted developer ecosystems — npm, GitHub Actions, and Go modules — to silently inject malicious code into software build pipelines. By compromising developer accounts and poisoning package registries, attackers gain access to downstream environments at scale without ever directly targeting end organizations. The use of GitHub as 'dead-drop' infrastructure makes detection harder because traffic blends in with legitimate developer activity. This matters because a single compromised package or workflow can cascade across thousands of projects and organizations, exfiltrating secrets like API keys, tokens, and credentials during routine CI\u002FCD operations.","**Immediate actions:**\n- Audit all third-party npm packages and GitHub Actions in use, pinning dependencies to verified commit SHAs rather than mutable tags.\n- Rotate any secrets, tokens, or credentials that may have been exposed in CI\u002FCD pipelines or GitHub workflow environments.\n- Enable two-factor authentication (MFA) on all developer accounts with access to package registries and source code repositories.\n\n**Detection measures:**\n- Implement software composition analysis (SCA) tools in CI\u002FCD pipelines to flag newly introduced or modified dependencies before build execution.\n- Monitor GitHub Actions workflow logs and npm install outputs for unexpected network calls, secret access patterns, or outbound connections to unknown hosts.\n- Set up alerting for any new package versions published under your organization's namespaces or forks of critical dependencies.\n\n**Long-term improvements:**\n- Establish a vetted internal package mirror or artifact registry to control which external packages are permitted in your build environment.\n- Adopt a formal Software Bill of Materials (SBOM) process so every build's dependency tree is inventoried, versioned, and auditable.\n- Train developers on supply chain attack vectors, including typosquatting, dependency confusion, and malicious GitHub Actions, as part of regular security awareness programs.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 6: Access Control Management","CIS Control 8: Audit Log Management","NIST SP 800-161: Supply Chain Risk Management Practices","NIST SP 800-218: Secure Software Development Framework (SSDF) – PW.4 (Reuse Existing, Well-Secured Software)","NIST CSF: ID.SC-3 (Suppliers and third-party partners are identified)","NIST CSF: DE.CM-3 (Personnel activity is monitored)","SLSA Supply Chain Security Framework – Level 2\u002F3 provenance requirements","OpenSSF Scorecard – Dependency Pinning and CI\u002FCD Best Practices","GDPR Article 32: Security of processing (where developer credential theft leads to data breach exposure)",{},"published","2026-06-26T12:20:42.76037+00:00","2026-06-26T12:20:42.463+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F06\u002Fmiasma-malware-targets-npm-packages-and.html","miasma-malware-targets-npm-packages-and-github-actions-in-supply-chain-attack-a28186","Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":39,"name":40,"slug":41,"description":42,"color":43},"1ec88fde-2d0f-4ed8-932a-33f5ccc0fdc7","Access Control","access-control","Excessive privileges, missing MFA, weak auth","#f97316",{"id":45,"name":46,"slug":47,"description":48,"color":49},"f0c2a0af-58aa-4128-87c9-6acd30f2dc48","Supply Chain","supply-chain","Third-party risk, compromised dependencies","#8b5cf6",[51],{"id":52,"date":53,"edition":54,"title":55,"audio_url":56},"89fd45c4-641b-4f96-bc93-e17a38675550","2026-06-26","afternoon","ThreatNoir Afternoon Brief — June 26","https:\u002F\u002Fcdn.threatnoir.com\u002Fpodcasts\u002F2026-06-26\u002Fthreatnoir-afternoon-brief-2026-06-26.mp3",[58,62,66],{"slug":59,"name":60,"problem":61},"identity-governance","Identity governance and single sign-on","People who leave or change roles lose access everywhere at once, and forgotten accounts stop piling up.",{"slug":63,"name":64,"problem":65},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",{"slug":67,"name":68,"problem":69},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship."]