- Attackers successfully published over 286 malicious versions across 57 distinct npm packages.
- A novel 'Phantom Gyp' technique was used to bypass traditional security scanners.
- The malware targets a wide range of cloud credentials, including AWS, Azure, and Google Cloud.
- Injected backdoors now target AI coding assistants like Claude and Cursor to maintain persistence.
The digital world recently received a massive wake-up call with a sophisticated supply chain strike hitting the npm registry. Dubbed the Miasma campaign, and frequently linked to the IronWorm lineage, this series of events compromised dozens of trusted packages used by thousands of developers and major organizations globally.
Unlike your run-of-the-mill typosquatting attempts, this operation specifically targeted the actual maintenance pipelines of reputable developers and SDK providers. It successfully injected hundreds of malicious versions into the wild, bypassing traditional security layers with a level of technical finesse that has left the industry scrambling.
The Evasive Mechanics of the Phantom Gyp Strategy
Security professionals usually tell you to keep a sharp eye on your package.json for suspicious lifecycle scripts. However, this threat actor turned that advice on its head by utilizing a 157-byte binding.gyp file to trigger code execution. Since many security scanners only look for preinstall or postinstall entries, this method, known as Phantom Gyp, slipped right under the radar during initial deployment.
Once the installation process kicks off, the malware doesn’t just sit idle. It pulls down a standalone Bun JavaScript runtime to execute its heavy lifting outside of the standard Node.js environment. This allows the attackers to dodge several monitoring tools that were specifically tuned to watch for suspicious node process behaviors, making the infection much harder to catch in real-time.
Targeted Credential Harvesting and Cloud Breaches
The endgame for the Miasma and IronWorm actors is clear: total infrastructure access. The malware acts as a precision instrument designed to scrape secrets across AWS, Azure, and GCP environments. It doesn’t just look for static environment variables; it actively probes specific metadata endpoints and extracts unmasked secrets directly from the memory of CI/CD runners where they are most vulnerable.
GitHub environments are also primary targets, as the payload aggressively pursues GITHUB_TOKEN values and other sensitive repository keys. It even goes after password managers or local SSH keys, ensuring that once an attacker has a foothold, they can move laterally through an organization’s entire digital estate with minimal resistance.
Poisoning the Future of AI-Assisted Coding
Perhaps the most forward-thinking and concerning part of this attack is how it targets AI coding assistants. By injecting backdoor configurations into tools like Claude and Cursor, the malware ensures it stays relevant even after the initial package is removed. If a developer opens a compromised project, these injected setup scripts run automatically, potentially influencing the very code suggestions the AI provides to the user.
This creates a particularly nasty cycle where the tools we use to write secure code are themselves compromised at the root. It is a true nightmare scenario for dev teams who rely on these AI tools for speed, as the backdoors are committed directly to repositories using stolen credentials that bypass traditional code review processes.
Defending against a sophisticated monster like Miasma requires more than just periodically updating your dependencies. It demands a layered defense-in-depth approach that includes blocking unknown outbound traffic from build servers, pinning versions with strict integrity hashes, and monitoring CI/CD runner memory. As we move forward, the security of our software supply chain remains a shifting battleground where trust is hard-earned and very easily exploited by determined adversaries.
