The npm Threat Landscape: Attack Surface and Mitigations (Updated July 15)
Summary: Unit 42 traced npm supply chain attacks from the September 2025 Shai-Hulud worm through a June 1, 2026 compromise of at least 32 @redhat-cloud-services packages and a July 14, 2026 campaign that pushed five trojanized packages to npm via four compromised AsyncAPI GitHub release pipelines. The July payload, a descendant of the Miasma RAT, was delivered when a developer opened a workspace in GitHub Copilot, which loaded the trojanized @asyncapi/specs@6.11.2 package without any manual npm install.
Bottom line: The Miasma RAT keeps working after its primary command-and-control server at 85.137.53[.]71 is blocked, falling back to an Ethereum smart contract, public Nostr relays and a BitTorrent DHT, so blocking one layer does not kill the implant. The AsyncAPI attackers never touched a protected main branch; they pushed to unprotected next and schema release branches, and the CI runner's own NPM_TOKEN published the backdoored packages under a trusted scope.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Threat Actors & Nation-State
- Related
- University of Texas at Arlington warns personal information stolen during cyberattack Cyber Risks · Nov 13, 2026Hackers Exploit PHP2Shell Flaws in Check Point Gateways to Deploy TSGA Backdoor and Wipe ESXi Files Cyber Risks · Nov 13, 2026Hackers compromise 4,800 GitHub accounts to steal cloud credentials Cyber Risks · Nov 12, 2026