Loading malware…
Miasma is a modular software supply-chain malware family and self-propagating worm associated with the broader Mini Shai-Hulud and Hades lineage and frequently linked to the financially motivated TeamPCP threat cluster. It has been used to compromise trusted developer ecosystems by poisoning packages and repositories across multiple platforms, especially npm and PyPI, with later activity also extending into developer source repositories and AI-assisted coding workflows. Miasma primarily targets developer workstations, CI/CD runners, and cloud-native engineering environments in order to steal credentials, maintain access, and spread through software publishing and source-control channels.
Observed Miasma variants have used several execution patterns. Earlier waves relied on package installation hooks, while later variants shifted to less conspicuous mechanisms such as execution through binding.gyp during package installation or hidden code embedded in ordinary runtime modules that activates when an affected package is imported. Some campaigns used staged Node.js loaders that retrieved encrypted follow-on payloads from decentralized hosting, while other variants deployed Bun-based payloads to reduce visibility in environments tuned for Node.js monitoring. In repository-focused intrusions, Miasma has also abused IDE and AI coding assistant configuration or task files so that opening a project can trigger execution.
Core capabilities consistently attributed to Miasma include credential theft, persistence, remote command execution, exfiltration, and self-propagation. The malware has harvested cloud credentials and tokens, package publishing credentials, source-control tokens, SSH material, Kubernetes and secrets-management data, CI/CD secrets, and AI developer tool configuration data. Some builds establish persistent user-level access across Linux, Windows, and macOS through platform-appropriate mechanisms. Multiple analyses also describe a remote-access or tasking component capable of encrypted beaconing, shell execution, file operations, payload replacement, and update handling. Certain samples contained broader reconnaissance, propagation, evasion, mutation, or destructive logic, though some of those features were disabled in specific observed builds.
Miasma’s propagation model is centered on abusing stolen maintainer and developer credentials to republish trojanized packages, create malicious repositories or workflows, and compromise downstream environments through trusted software distribution paths. This has enabled worm-like spread across open-source registries and developer infrastructure, including package ecosystems, GitHub repositories, and CI/CD pipelines. Campaigns attributed to Miasma have affected software used in cloud, serverless, API tooling, security scanning, and developer automation contexts, making organizations with exposed build systems and publishing credentials particularly at risk.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
4 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files.
The four CVEs associated with this campaign are CVE-2026-33634, CVE-2026-48027, CVE-2026-45321, and CVE-2025-55182. | Miasma was a variant of Mini Shai-Hulud that propagated across those same open-source registries while harvesting credentials and poisoning configuration files.
5 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
TeamPCP is the malware-developing crew behind the mini Shai-Hulud, Miasma, and Canister worms that have been poisoning open source registries and harvesting cloud access tokens, credentials, API keys, and other sensitive data.
The GitHub fingerprint the attackers left behind – a repository description reading “Alright Lets See If This Works” turned up on over 320 infected repositories before researchers began pulling the thread. That string is not something random. In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
The GitHub fingerprint the attackers left behind – a repository description reading “Alright Lets See If This Works” turned up on over 320 infected repositories before researchers began pulling the thread. That string is not something random. In the Shai-Hulud / Miasma family of supply chain worms, the description stamped onto attacker-created GitHub dead-drop repos has functioned as a campaign signature since the original wave hit in September 2025.
An infrastructure provider's networks have been breached and they were dealing with the Miasma worm. That worm, as it turns out, is pretty hard to catch and delete because it is self-spreading through IDE configuration settings and through AI assisted environments.
An infrastructure provider's networks have been breached and they were dealing with the Miasma worm. That worm, as it turns out, is pretty hard to catch and delete because it is self-spreading through IDE configuration settings and through AI assisted environments.
27 distinct techniques documented for this family, organized by ATT&CK tactic.
Command 11 (ShellExec) passes the request to child_process.exec().
Command 11 (ShellExec) passes the request to child_process.exec()... testMode is false in this seed, so the real shell runs
The first-stage JavaScript starts a detached background node -e process with ignored standard streams and windowsHide:true.
Each contains an obfuscated downloader injected into a normal runtime module... The node -e payload is obfuscated, but its string lookup table contains the IPFS URL and drop filename in plaintext.
The bundle contains a full credential harvester covering cloud credentials, package manager tokens, SSH/GPG keys, shell histories, browsers, CI/CD systems, AI developer tools, databases, wallets, containers, and password managers. None of this runs because toggles.recon is false
each beacon includes redacted previews of PATH, HOME, USER, and HOSTNAME
Even with reconnaissance switched off, those messages contained redacted previews of environment information and checked for configuration files tied to developer tools.
The implant beacons to hxxp://85[.]137[.]53[.]71:8080 roughly every 30 seconds.
The malware contacted an HTTP command-and-control server about every 30 seconds and sent encrypted beacons.
That child process downloads sync.js from IPFS and runs it in the background.
That child process downloads sync.js from IPFS and runs it in the background.
129 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
70 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A persistent cross-platform Node.js implant delivered through trojanized AsyncAPI npm packages. It downloads and decrypts a second-stage payload from IPFS, establishes persistence on macOS, Windows, and Linux, beacons to an HTTP C2 server, and provides a remote shell for command execution and data collection.
A persistent backdoor delivered via compromised npm packages. It activates when affected Node.js modules are loaded, spawns a detached child process, retrieves a second-stage payload from IPFS, establishes encrypted remote communications, enables arbitrary shell execution, supports payload replacement, and attempts user-level persistence on Linux, Windows, and macOS.
A Miasma-family payload delivered through compromised AsyncAPI npm packages. The first stage launches a detached Node.js process that downloads sync.js from IPFS; the final payload is described as a tasking framework supporting file operations, shell execution, update handling, beacon timing changes, and persistence logic.
A multi-stage botnet framework delivered via compromised npm packages. The first stage executes at require() time, launches a detached Node.js child process, downloads an encrypted second-stage payload from IPFS, and persists it as sync.js. The second stage is described as having shell command execution, file operations, credential harvesting, evasion checks, persistence, and multi-protocol command-and-control capabilities.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.