Miasma npm Worm Self-Replicates Across Repositories

What's Different This Time

This is not another malicious package upload. Miasma is a self-replicating worm that propagates autonomously across repositories. It compromised 73 Microsoft GitHub repos across four organizations and injected payloads into 50+ npm packages. A related campaign (IronWorm) is operating simultaneously. Both are described as ongoing and not contained.

Your exposure isn't 'did I install a bad package' — it's 'did any of my transitive dependencies pull from a compromised Microsoft repo in the last N days.'

The payload is a Rust-based information stealer — a compiled native binary that JavaScript static analysis tools and npm audit cannot detect. It won't show up in your existing security scanning. Look for unexpected postinstall scripts, native binary downloads, and new network connections during npm install/build phases.

Why Traditional Defenses Are Blind

The attack exploits a structural gap. Most teams trust packages from Microsoft organizations. The worm specifically targets that trust by compromising the repos themselves, then infecting dependents automatically. If your CI/CD auto-merges Dependabot PRs or uses floating version ranges for Microsoft packages, you are in the blast radius without any direct action on your part.

Simultaneously, an AI agent discovered 21 zero-day vulnerabilities in FFmpeg's C codebase in a single pass. FFmpeg is the media processing substrate of the internet — it's in your video transcoding, thumbnail generation, and likely your mobile app's media handling. These zero-days don't have patches yet. If you accept user-uploaded media anywhere in your stack, you're exposed.

The Structural Shift

Two patterns are converging: AI-powered vulnerability discovery is finding bugs faster than vendors can patch (Anthropic's Project Glasswing now at 150+ companies), and self-replicating attack tooling can weaponize those discoveries without human operators. The era of 'patch when available' as a primary strategy is ending. Defense-in-depth and blast radius containment are now primary, not secondary.

The Pattern Across Five Signals

The disclosures below share a root cause. Treating LLM refusal as a security boundary is a category error. The vendors have now said so on the record.

The Correct Architecture

If the policy can be talked out of its decision in English, it is not a policy. It is another model.

The fix is structural, not prompting. OpenAI's own answer is to remove capabilities, not harden them. The pattern that holds up under load:

1. The LLM proposes actions. It never executes them directly.
2. A deterministic policy layer authorizes: cryptographic challenge, human approval, or scoped capability token.
3. Tool calls are signed and bounded, so the worst-case prompt produces a bounded action.
4. Untrusted content processing is separated from tool-calling. Different model call, different credential scope.

Microsoft's 7 new AI agent failure modes go past prompt injection. The taxonomy covers multi-turn context poisoning, tool-use exploitation with attacker-controlled parameters, capability escalation through tool chains, and persistence across conversation boundaries. Mapping it against an existing agent architecture is a useful afternoon. Most architectures cover one or two of the seven.

HuggingFace: The Quiet One

The Transformers RCE via config files ships against 2.2 billion installs. By volume, it is probably the most broadly exploitable item on the list. Most teams treat config.json as inert metadata. It is not. Calling from_pretrained() against anything outside your control executes arbitrary code on your GPU inference nodes. Those nodes typically hold training data, model weights, cloud credentials, and a path into the rest of the network. The config file is the payload.