OpenSourceMalware Show #7 Examines Miasma, Moika and Shifting Supply-Chain Attacks
Summary
The episode discusses the Miasma package campaign, Moika’s credential-stealing packages, shifts toward CI pipeline attacks, and trends in malicious packages and AI skills.
Key points
- Miasma expanded from 32 compromised Red Hat cloud-services packages to more than 80 packages and 286+ malicious versions across npm, PyPI and RubyGems.
- A guest corrected the initial account: the Red Hat compromise was attributed to gaps in npm trusted publishing, not a GitHub Actions vulnerability. TeamPCP has not claimed responsibility for use of its open-sourced worm.
- The hosts say attackers increasingly target CI pipelines, automated builds and developer tools; credential abuse may begin within seconds of compromise.
- Their January-to-mid-May 2026 data showed npm remained the largest source of malicious packages, while PyPI activity grew at a comparable rate and often correlated with npm campaigns.
- They reported that about 60–65% of records added during the week of May 11 were tagged as account takeovers.
- The hosts counted more than 700 malicious ClawHub skills by the end of March; nearly a fifth appeared aimed at marketing roles.
- Moika was linked to over 260 threat reports and nearly 300 packages; the hosts noted credential-stealing payloads but described attribution and whether the activity was researcher-related as uncertain.
Article Details
- Event Type
- Software supply-chain malware and malicious package activity
- Impact
- The Miasma campaign compromised 32 Red Hat cloud services packages averaging about 80,000 weekly downloads and reportedly expanded to more than 80 packages and at least 286 malicious versions. The worm steals credentials and spreads across npm, PyPI, and RubyGems. A BoostSecurity security research executive said the initial compromise exploited gaps in npm trusted publishing, not a GitHub Actions vulnerability. The Moika campaign has more than 260 verified threat reports and nearly 300 deployed packages; some payloads are described as overtly credential-stealing, though the campaign’s nature and attribution remain disputed. Events Channel, described as a confirmed typosquat, was still live on npm with 168,000 downloads at the time of the discussion.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | oob[.]moika[.]tech | Identified as part of the Moika campaign’s C2 infrastructure. |
MITRE ATT&CK
People
Adnan KhanDescribed the Miasma worm’s combined tradecraft during the discussion.DarshanDiscussed as a bug bounty researcher associated with dependency-confusion and typosquatting packages; the source says JPD is their call sign.FrancoisIdentified as BoostSecurity’s VP of Security Research; said the Miasma compromise abused gaps in npm trusted publishing rather than a GitHub Actions vulnerability.Rami-MacReportedly assessed that the Miasma-related package compromises were probably conducted by the same threat actor; this attribution was presented as uncertain.
Threat Actors
Malware
Vendors
Products
ClawHubwith account takeovers representing 60 to 65% of new records in the week of May 11th. Third, malicious ClawHub skills have grown rapidly since January, with over 700 in the database by end of March. Nearly a fifthGitHub Actionsnot part of the original open-sourced code. The initial Red Hat compromise came not through a GitHub Actions vulnerability but through abused gaps in npm trusted publishing. A live comment from Francois (VP ofnpmTeamPCP’s open-sourced MiniShai Hulud worm, though TeamPCP has not claimed credit. It is multi-ecosystem (npm, PyPI, RubyGems) and the Ruby variant appears to be LLM-translated, not part of the original open-sourcedPyPIopen-sourced MiniShai Hulud worm, though TeamPCP has not claimed credit. It is multi-ecosystem (npm, PyPI, RubyGems) and the Ruby variant appears to be LLM-translated, not part of the original open-sourced code.RubyGemsMiniShai Hulud worm, though TeamPCP has not claimed credit. It is multi-ecosystem (npm, PyPI, RubyGems) and the Ruby variant appears to be LLM-translated, not part of the original open-sourced code. The