Attackers hit 42 GitHub repos with files too large to search
Oversized wrappers and a native addon hid one CI-publisher payload while an npm worm stole tokens and spread through Actions.
76
Malware
Miasma
- Mentions · 7d2
- Mentions · 30d3
- All mentions7
- First seenAug 27, 2026
- Last mentioned3d ago
Timeline
7 articles · newest firstMiasma npm worm armed 42 GitHub repositories, JFrog says
Oversized blobs hid credential theft and a token-revocation wiper on real developer accounts, not only test repos.
74
Your AI Agent Doesn’t Have MFA
Report says AI agents lack MFA and have already misused credentials and spread malware.
66
Lumma, RedLine and Vidar Infostealers Fuel Cloud Credential Theft Campaigns
Lumma, RedLine, and Vidar steal cloud and developer credentials, enabling session hijacking that bypasses MFA.
62
The Infostealer Incursion: How Stolen Credentials Breach Cloud, Code, and AI Environments
Wiz finds Lumma, RedLine, and Vidar dominate infostealer theft of AWS, GitHub, and OpenAI credentials from endpoints.
64
AI Is Giving Lesser-Resourced Attackers Nation-State-Level Reach, Google Warns
Google's Threat Intelligence Group warns AI now gives lesser-resourced criminal and nation-state attackers nation-state-level speed and scale, citing TeamPCP, Basin Castle, APT42, and APT24 usage.
68
Two Arrests, One Supply-Chain Attack, and a Lot of Stolen Credentials
AFP charges two men over TeamPCP open-source supply-chain attacks that stole 500,000+ credentials from 1,000+ organizations via four malware families.
68
Related CVEs
by mentions- CVE-2026-4194099%9.3Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
Appears with
- Googlevendor · 4
- Shai-Huludmalware · 3
- Mini Shai-Huludmalware · 3
- npmproduct · 3
- GitLabproduct · 2
- Verizonorganization · 2
- JINX-0164threat actor · 2
- Vidarmalware · 2
- NordStellarorganization · 2
- Microsoftvendor · 2
- JFrogorganization · 2
- GitHubproduct · 2
- CISAorganization · 2
- SafeDeporganization · 2
- GitHubvendor · 2
- Geminiai model · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.