Threats Tagged 'miasma v3'

In July 2026, four AsyncAPI npm packages were compromised to deliver Miasma v3, a new variant of a worm previously seen in Red Hat packages. The malicious packages were published via AsyncAPI's legitimate GitHub Actions workflow using npm's OIDC integration, resulting in valid provenance attestations. This variant activates when the poisoned library is loaded, not during installation, downloading a second-stage payload from IPFS that establishes a persistent Node.js backdoor capable of arbitrary shell command execution. The attack started with an unauthorized commit to the repository's release branch, underscoring the need for branch protection even with trusted-publisher mechanisms. The primary function of this deployment is a remote access trojan, although the codebase includes modules for credential theft, propagation, and AI-tool poisoning. No known exploits in the wild have been reported.