Myasna Worm Source Code Leaked as npm Plans Install-Script Controls

Summary

This roundup covers the Myasna worm’s leaked source, compromised developer accounts and GitHub C2, npm’s planned install-script approvals, an AUR supply-chain compromise, and claims about NSO Group and Anthropic’s guarded AI models.

Key points

Researchers captured Myasna worm source code after it appeared on GitHub on June 8; SafeDep published an analysis.
The report says attackers used compromised developer accounts to publish repositories. Myasna used GitHub commit search as C2 and affected npm, PyPI, Ruby gems, and EC2 instances.
Myasna could kill developer machines if it found stolen tokens had been revoked; it also had paths for exfiltrating information and spreading to new victims.
npm’s announced upcoming release requires developers to approve or deny dependency install scripts and provides tooling to review pending scripts.
Accudo Security said credential stealers and worms abused install scripts, allowing malicious code to affect developers during npm install without importing or running the package.
Sonatype reported that more than 20 Arch Linux AUR packages were compromised in the Atomic Hash campaign at the time of discovery.
Meta alleged that NSO Group continued targeting WhatsApp users. The roundup also reported that Anthropic imposed safeguards on Fable and Mythos and later disabled customer access to both.

Article Details

Topics: [00:12] Myasna worm source code, compromised developer accounts, GitHub C2, and affected package ecosystems
[02:01] npm’s planned dependency install-script approval and review controls
[05:04] Nightmare Eclipse’s announced potential Windows Defender offline scan attack vector
[05:24] Meta’s allegation that NSO Group continued targeting WhatsApp users
[05:38] Atomic Hash supply-chain attack against Arch Linux AUR packages
[06:01] Anthropic’s Fable and Mythos safeguards, government access directive, and access suspension