cyber.hendryadrian.com
Threat Research · bleepingcomputer.com

Miasma Worm Source Code Leaked on GitHub, Revealing Supply-Chain Capabilities

· Original article ↗

Summary

SafeDep says Miasma’s source code was deliberately posted to GitHub through compromised developer accounts. Its analysis describes credential theft, GitHub-based propagation, destructive token-revocation behavior, and obfuscated payload builds.

Key points

  • SafeDep reported that source code was posted to GitHub repositories named “Miasma-Open-Source-Release” through compromised developer accounts, apparently as a deliberate release.
  • Miasma appears to evolve from the Shai-Hulud worm and reportedly shares code and techniques with it.
  • The framework harvests cloud, CI/CD, password-manager, Kubernetes, and secret-store credentials, then uses GitHub to compromise repositories, workflows, and packages across npm, PyPI, and RubyGems without separate C2 infrastructure.
  • The source code supports lateral movement through SSH and AWS Systems Manager and can poison configurations for AI coding tools.
  • A code component monitors a stolen GitHub token; if the token is revoked, it can delete files in the user’s home and Documents folders. The monitor can run for up to 72 hours on Linux or macOS.
  • SafeDep describes a five-stage build pipeline using encryption and randomized obfuscation to make payloads harder to detect with signatures or static analysis.
  • The article advises developers to pin dependencies, delay adopting new package updates, and validate builds in isolated environments.

Article Details

Attack Vectors
  • Miasma steals cloud, CI/CD, password-manager, Kubernetes, and secret-store credentials from infected developer machines, then uses them to compromise repositories, workflows, and package ecosystems.
  • The malware publishes trojanized packages to npm, PyPI, and RubyGems to infect downstream developers and propagate through the software supply chain.
  • Miasma uses GitHub for command-and-control activity and can use a victim's stolen GitHub token as an exfiltration channel.
  • The framework can move laterally through SSH and AWS Systems Manager (SSM), and poison configurations for AI coding tools.
  • A monitor installed as a systemd user service on Linux or a LaunchAgent on macOS can run a destructive file-deletion command if the stolen GitHub token is revoked.
Defensive Notes
  • Pin project dependencies.
  • Introduce multi-day delays before adopting newly released package updates.
  • Validate new builds in isolated test environments.

MITRE ATT&CK

T1021.004 · SSHThe framework can move laterally through SSH.T1021.007 · Cloud ServicesThe framework can move laterally through AWS Systems Manager (SSM).T1027 · Obfuscated Files or InformationThe build pipeline uses encrypted assets, randomized string obfuscation, source transformations, JavaScript obfuscation, and layered encryption to make samples harder to analyze.T1059.004 · Unix ShellThe token-revocation response runs destructive rm -rf commands.T1078 · Valid AccountsMiasma uses stolen credentials, including GitHub tokens, to compromise repositories and packages.T1102 · Web ServiceThe malware uses GitHub in place of dedicated command-and-control infrastructure.T1195.002 · Compromise Software Supply ChainMiasma propagates by publishing trojanized packages to npm, PyPI, and RubyGems, and compromising repositories and workflows.T1485 · Data DestructionIf the stolen GitHub token is revoked, the monitor executes commands that recursively delete files and directories in the user's home and Documents folders.T1543.001 · Launch AgentOn macOS, the token monitor runs as a LaunchAgent.T1543.002 · Systemd ServiceOn Linux, the token monitor runs as a systemd user service.T1555 · Credentials from Password StoresThe framework harvests credentials from password managers.T1567 · Exfiltration Over Web ServiceA stolen GitHub token can be used as an exfiltration channel.

Malware

MiasmaMiasma, a credential-stealing attack framework tied to supply-chain attacks, was briefly open-sourced on GitHub after being leaked through compromised developer accounts.Shai-HuludIt evolves from Shai-Hulud, steals cloud and build credentials, and uses GitHub to spread trojanized packages across ecosystems like npm, PyPI, RubyGems, and JFrog Artifactory.

Products

AWS Systems ManagerIt can also move laterally through SSH and AWS Systems Manager (SSM), and poison configurations of AI coding tools such as Claude, Gemini, Cursor, Copilot, Kiro, and Cline.ClaudeIt can also move laterally through SSH and AWS Systems Manager (SSM), and poison configurations of AI coding tools such as Claude, Gemini, Cursor, Copilot, Kiro, and Cline.ClineIt can also move laterally through SSH and AWS Systems Manager (SSM), and poison configurations of AI coding tools such as Claude, Gemini, Cursor, Copilot, Kiro, and Cline.CopilotIt can also move laterally through SSH and AWS Systems Manager (SSM), and poison configurations of AI coding tools such as Claude, Gemini, Cursor, Copilot, Kiro, and Cline.CursorIt can also move laterally through SSH and AWS Systems Manager (SSM), and poison configurations of AI coding tools such as Claude, Gemini, Cursor, Copilot, Kiro, and Cline.GeminiIt can also move laterally through SSH and AWS Systems Manager (SSM), and poison configurations of AI coding tools such as Claude, Gemini, Cursor, Copilot, Kiro, and Cline.GitHubMiasma, a credential-stealing attack framework tied to supply-chain attacks, was briefly open-sourced on GitHub after being leaked through compromised developer accounts.JFrog ArtifactoryIt evolves from Shai-Hulud, steals cloud and build credentials, and uses GitHub to spread trojanized packages across ecosystems like npm, PyPI, RubyGems, and JFrog Artifactory.KiroIt can also move laterally through SSH and AWS Systems Manager (SSM), and poison configurations of AI coding tools such as Claude, Gemini, Cursor, Copilot, Kiro, and Cline.KubernetesThe malware steals cloud, CI/CD, password manager, Kubernetes, and secret store credentials.npmIt evolves from Shai-Hulud, steals cloud and build credentials, and uses GitHub to spread trojanized packages across ecosystems like npm, PyPI, RubyGems, and JFrog Artifactory.PyPIIt evolves from Shai-Hulud, steals cloud and build credentials, and uses GitHub to spread trojanized packages across ecosystems like npm, PyPI, RubyGems, and JFrog Artifactory.RubyGemsIt evolves from Shai-Hulud, steals cloud and build credentials, and uses GitHub to spread trojanized packages across ecosystems like npm, PyPI, RubyGems, and JFrog Artifactory.

Related Articles