The ‘Miasma’ worm source code briefly leaked on GitHub
Miasma’s source code briefly appeared on GitHub after compromised developer accounts were used to publish it. Researchers say the leak could help attackers adapt the worm and widen supply-chain attacks.
Intelligence analysis by GPT-5.4 Mini
SafeDep says the Miasma credential-stealing worm was deliberately posted to GitHub from compromised developer accounts, echoing the earlier Shai-Hulud leak. The code shows a self-propagating supply-chain worm that steals credentials, poisons packages, and can even destroy files if a stolen token is revoked.
A bad piece of software meant to spread by itself showed up on GitHub for a short time. It steals login keys, sneaks into software packages, and can even erase files if someone stops it, like a thief that also leaves traps behind.
Analysis
What was leaked
SafeDep says the Miasma source code was published on GitHub through multiple compromised developer accounts, in repositories named Miasma-Open-Source-Release. That pattern suggests the release was intentional rather than accidental, similar to the earlier Shai-Hulud leak.
What Miasma does
The framework is built to infect a developer machine, steal credentials from cloud services, CI/CD systems, password managers, Kubernetes, and secret stores, then use those secrets to compromise npm, PyPI, RubyGems, GitHub repositories, Actions workflows, and JFrog Artifactory. It can also move through SSH and AWS Systems Manager, and it can tamper with settings used by AI coding tools including Claude, Gemini, Cursor, Copilot, Kiro, and Cline.
Why the leak is dangerous
SafeDep says Miasma does not need its own command-and-control setup because it uses GitHub for coordination and abuse. The code also includes a destructive “dead-man switch” tied to a stolen GitHub token: if the token is revoked, the malware can run commands that delete files in the user’s home and Documents folders.
The leak also exposes a five-stage build process that makes each payload look different. According to SafeDep, it uses per-file AES-256-GCM encryption, randomized obfuscation, source transformations, JavaScript obfuscation, and a self-extracting loader. That makes static detection harder and helps each build evade simple signatures.
The article says the earlier Shai-Hulud leak was followed by more advanced variants and higher attack rates. The same pattern could repeat here if threat actors reuse the code and adapt it for new campaigns. For defenders, the practical advice remains the same: pin dependencies, delay adoption of fresh package releases, and test builds in isolated environments before trusting them.
Key points
- SafeDep says the Miasma source code was briefly leaked on GitHub from compromised developer accounts.
- Miasma steals credentials and uses them to attack package registries, repositories, CI/CD systems, and cloud services.
- The code includes a dead-man switch that can delete files if a stolen GitHub token is revoked.
- A multi-stage build pipeline makes each payload unique and harder to detect with signatures.
- Researchers warn the leak could fuel more supply-chain attacks across the open-source ecosystem.
If defenders move quickly, the leak can help them study Miasma’s tricks and build better detections. The source code also gives developers a clearer list of what to lock down, from package updates to cloud credentials.
If attackers reuse the leaked code, the worm could spread faster across open-source projects and package registries. Its obfuscation and token-based coordination could also make it harder for defenders to spot and contain before it reaches downstream victims.
