Compromised npm packages in the AsyncAPI namespace deliver the Miasma botnet loader, according to Socket AI Scanner. The malicious packages @asyncapi/generator-helpers, @asyncapi/generator-components,…
A self-replicating worm called Miasma, attributed to threat actor TeamPCP, is targeting AI coding tools by injecting malicious hooks into configuration files of Claude Code, GitHub Copilot, Gemini CLI…
A new supply chain attack wave from the Mini Shai-Hulud, Miasma, and Hades malware family has compromised LeoPlatform and RStreams npm packages, GitHub Actions workflows, and the Verana Blockchain Go …
A Miasma worm variant infected 20 npm packages under the LeoPlatform organization on June 24, 2026, after an attacker compromised a single maintainer's tokens. The malicious payload, a polymorphic cre…
Airgap, a new Linux tool, wraps programs in namespaces to hide secrets from AI agents and block npm malware that steals credentials at install time. It redacts sensitive files like .env and SSH keys f…
Attackers are increasingly targeting developer endpoints to steal credentials, as demonstrated by supply chain attacks like Megalodon, TrapDoor, and Miasma. GitGuardian's new Developer Endpoint Protec…
Socket Threat Research identified shai_hulululud@1.0.48596, an npm package designed to probe AI-based malware scanners using prompt injection, token flooding, and obfuscated JavaScript. The package co…
A new variant of the Miasma worm has been discovered exploiting npm's binding.gyp build file to execute malicious code during package installation, bypassing traditional package.json script audits. Th…
The Miasma software supply chain attack toolkit has been released as open source across multiple GitHub repositories, likely through compromised developer accounts. The toolkit enables attackers to ex…
Amazon's Project Nara, an end-to-end AI production suite, is now available to independent filmmakers through a new grant program, as announced at the AI on the Lot conference in Culver City, which dre…