🎯 Threat Intelligence
🔹 npm Supply Chain Escalation: From Shai-Hulud to Miasma RAT
Unit 42's updated report documents a sharp escalation in npm supply chain attacks following the Shai-Hulud worm in September 2025. The worm automated compromise and redistribution of malicious packages, shifting npm attacks from isolated typosquatting to systematic, weaponized campaigns.
🔹 Campaign Timeline
April 2026: Two campaigns identified. "Shai-Hulud: The Third Coming" started April 22. "Mini Shai-Hulud" began April 29.
May 2026: TeamPCP continued the Mini Shai-Hulud campaign with two new waves. One introduced a credential-free initial access technique. The other generated the highest single-hour package count of any Shai-Hulud worm to date. Copycat activity has since complicated attribution.
June 2026: At least 32 packages under the @redhat-cloud-services npm namespace were compromised. The attacker bypassed code review entirely and pushed a payload named Miasma.
July 2026: Attackers compromised release pipelines of four core AsyncAPI GitHub repositories on July 14. The campaign, calling itself miasma-train-p1, published five trojanized packages: • @asyncapi/generator@3.3.1 • @asyncapi/specs@6.11.2 • @asyncapi/specs@6.11.2-alpha.1 • @asyncapi/generator-helpers@1.1.1 • @asyncapi/generator-components@0.7.1
The payload is assessed as a descendant of the Miasma RAT.
🔹 Core TTP Shifts
-
Wormable propagation: Payloads steal npm tokens and GitHub PATs to automatically infect and republish legitimate packages, as seen in the March 2026 Axios compromise.
-
Infrastructure-level persistence: Attackers embed into CI/CD pipelines for long-term, undetectable access to enterprise environments.
-
Multi-stage payloads: Dormant sleeper dependencies activate only under specific environmental conditions, evading automated scanners.
🔹 Attack Chain • Initial Access: Credential-free techniques, stolen npm tokens, GitHub PATs • Persistence: CI/CD pipeline compromise • Execution: Miasma RAT and descendants • Propagation: Automated republishing of trojanized packages • Evasion: Sleeper dependencies with conditional activation
Monitor for campaign identifiers "miasma-train-p1" and "Shai-Hulud: The Third Coming" in infrastructure logs.
🔹 npm #SupplyChain #ShaiHulud #MiasmaRAT #ThreatIntelligence