Miasma npm worm armed 42 GitHub repositories, JFrog says
Oversized blobs hid credential theft and a token-revocation wiper on real developer accounts, not only test repos.
74
Malware
Mini Shai-Hulud
- Mentions · 7d1
- Mentions · 30d3
- All mentions13
- First seenAug 11, 2026
- Last mentioned4d ago
Timeline
13 articles · newest firstYour AI Agent Doesn’t Have MFA
Report says AI agents lack MFA and have already misused credentials and spread malware.
66
Hackers Are Turning Trusted Software Updates Into Credential-Stealing Malware
Supply-chain worms in npm packages, including Nx, steal developer credentials and can enlist local AI coding tools.
76
Supply Chain Attacks Turn Developer Machines Into Gateways for Cloud Breaches
Qualys says supply-chain malware on developer machines is stealing cloud credentials and enabling downstream breaches.
72
Attackers Target Developer Credentials to Expand Supply Chain Intrusions Beyond Source Code
Malicious npm packages, including Mini Shai-Hulud, steal developer and CI/CD cloud credentials during install.
62
GitHub Actions re-enabled with Mini Shai-Hulud payload still active
Two compromised GitHub Actions stayed live for nine days still serving the Mini Shai-Hulud payload.
78
Compromised GitHub Actions Came Back Online and Resumed Executing Mini Shai-Hulud Malware
Re-enabled GitHub Actions again executed Mini Shai-Hulud payloads that stole CI/CD credentials.
78
An undercover Google analyst infiltrated a notorious supply-chain hacking gang
Google's Mandiant planted an undercover analyst inside TeamPCP, the supply-chain gang that breached 1,000+ companies via poisoned open-source packages before two Australian arrests.
88
An Undercover Google Analyst Infiltrated a Notorious Supply Chain Hacking Gang
Google revealed a Mandiant undercover analyst infiltrated TeamPCP, letting it warn hundreds of victims and disrupt the gang's supply chain attacks and extortion.
82
Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
77 malicious 'evil twin' Open VSX extensions impersonated developer tools and exfiltrated hostnames and detailed workspace reconnaissance to mangorbit.com.
40
Two alleged TeamPCP members arrested and charged after months of software supply
Australian Federal Police, with FBI support, arrested two alleged TeamPCP members behind supply-chain attacks that compromised over 1,000 organizations.
72
Two Arrests, One Supply-Chain Attack, and a Lot of Stolen Credentials
AFP charges two men over TeamPCP open-source supply-chain attacks that stole 500,000+ credentials from 1,000+ organizations via four malware families.
68
Tracking Shai-Hulud: Inside the ChainDrop NPM Worm
ChainDrop, a Mini Shai-Hulud variant tied to TeamPCP, worms through npm via a compromised maintainer account and anchors C2 in an Ethereum smart contract.
68
Related CVEs
by mentions- CVE-2026-4194099%9.3Missing-Authentication Bypass in WebPros cPanel & WHM (AuthBypass to RCE)
Appears with
- TeamPCPthreat actor · 7
- npmproduct · 6
- Shai-Huludmalware · 5
- Australian Federal Policeorganization · 5
- FBIorganization · 5
- European Commissionvictim · 4
- GitHubvendor · 4
- Socketorganization · 3
- Microsoftvendor · 3
- Googlevendor · 3
- Miasmamalware · 3
- Western Australia Police Forceorganization · 3
- GitHuborganization · 3
- Trivyproduct · 3
- GitHub Actionsproduct · 3
- OpenAIvendor · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.