Iron Worm and New Miasma Worm Variant Hit npm in Supply Chain Attacks
Summary: Two npm supply chain campaigns used more than 50 legitimate packages to distribute a Rust-based information stealer JFrog codenamed IronWorm and a new Miasma worm variant that compromised 57 packages across more than 286 malicious versions. IronWorm was traced to a compromised npm account "asteroiddao" and pushed commits under the author name "claude" across nine GitHub organizations, while the Miasma wave used a 157-byte binding.gyp file, a technique StepSecurity calls "Phantom Gyp," to trigger code execution during npm install.
Bottom line: The Miasma variant injects persistent backdoor files into project repositories that execute whenever a developer opens the project in an AI-assisted IDE, and it exfiltrates stolen data to public GitHub repositories tagged "Miasma: The Spreading Blight" - a channel most security tools are not configured to treat as suspicious.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026