Miasma worm burrowed through npm for two months

A self-propagating npm worm that researchers named Miasma spent roughly seven weeks in the summer of 2026 moving from one maintainer account to the next, harvesting cloud and CI credentials and using them to publish poisoned versions of whatever packages it could reach. Red Hat, the AsyncAPI project, and the voice-AI vendor Vapi were among the names it burned through.

Miasma's first widely reported outing came on May 29, 2026, when an attacker used a Red Hat employee's GitHub account to inject a malicious preinstall script into packages in the @redhat-cloud-services npm namespace. Red Hat said the account had itself been compromised by a malicious VS Code extension, which is a reminder that the worm did not need to break npm to get npm publish rights.

Five days later the operators changed how the code fired. On June 3, StepSecurity documented a wave it called "Phantom Gyp," in which the payload abandoned preinstall and postinstall hooks entirely and instead hid execution inside a 157-byte binding.gyp file. Because node-gyp evaluates shell commands in that file during dependency installation, the code ran on npm install without ever appearing in a lifecycle-script scanner. Snyk counted 57 affected packages and more than 300 malicious versions.

The July 14 AsyncAPI compromise moved the trigger again, this time to module import. Socket said the loader fetched an 8.25 MB encrypted second stage from IPFS and unpacked a modular tasking framework with shell execution, file transfer, and systemd persistence. Across all three waves the objective stayed constant: credentials from developer laptops and build runners, exfiltrated to attacker-controlled GitHub repositories and then reinvested in the next round of publishing.