Miasma Worm Spreads via Dependabot Auto-Merge in CI/CD

The Miasma Worm: Self-Replicating Supply Chain Compromise

A self-replicating worm has hit 73 Microsoft GitHub repos across four organizations and poisoned 50+ npm packages. The payload is a Rust-based information stealer — a compiled native binary that won't trigger JavaScript static analysis tools. Your npm audit is blind to this. The campaign is described as ongoing and not contained.

This is not 'did I install a bad package.' It is 'did any of my transitive dependencies pull from a compromised Microsoft repo in the last N days.' The worm propagates autonomously across repositories.

The attack vector targets postinstall scripts that download binaries, and spreads by infecting dependent packages automatically. If your CI/CD auto-merges Dependabot PRs or uses floating version ranges for Microsoft-org packages, you have the exact exposure profile the worm exploits.

Hugging Face Transformers: Config Files Are Now Attack Surface

Separately, Hugging Face Transformers (2.2 billion installs) has a critical RCE exploitable through model configuration files — not model weights. Most teams treat config.json as safe metadata. It isn't. If the library instantiates objects based on config values, attackers embed execution primitives in what looks like hyperparameters. GPU inference nodes are high-value targets: training data access, model IP, cloud credentials, lateral network access.

The Compound Threat

Both attacks exploit the same architecture flaw: trusted update paths with insufficient verification. The npm worm exploits dependency trust. The HuggingFace vuln exploits config trust. In both cases, the content passes through paths your security tooling considers safe.

Immediate Actions

1. Run npm ls against known-bad package lists (GitHub advisories, npm security advisories). Look for unexpected postinstall scripts or native binary downloads in recently-updated dependencies.
2. Audit all from_pretrained() calls — identify where model configs are parsed from untrusted sources. Isolate model loading in containers with minimal privileges and no network egress.
3. Pin and verify checksums for any dependencies sourced from Microsoft GitHub organizations. Review recent CI runs for unexpected network connections.
4. Add runtime behavioral monitoring to CI/CD — detect unexpected network calls and native binary execution during npm install/build phases.

Vendor-Level Admissions This Week

The agent security story converged from three vendors at once, all pointing at the same conclusion: prompt-level defenses don't work.

1. OpenAI shipped Lockdown Mode, which disables Deep Research and Agent Mode rather than hardening them. The defense is feature removal. You ship that when you've concluded the attack surface is undefendable.
2. Meta's AI chatbot was socially engineered into changing account emails on high-profile Instagram accounts. The chatbot held write access to the identity system. No prompt injection needed, just a conversation that went somewhere it shouldn't have.
3. Claude Code's MCP protocol has a vulnerability in the integration layer itself, exploitable against developers who trust the tooling.

An LLM agent that touches auth should hold a credential narrow enough that the worst-case prompt produces a bounded action. If the policy can be argued out of its decision in English, it's another model, not a policy.

The Fix Is Architectural, Not Better Prompting

The shared mechanism: the model is a confused deputy by design. It treats instructions and data as the same tokens because that's what a language model is. The fix is structural.

Claude Code's 7-Tier Permission Model as Reference

Anthropic's implementation is the working reference design: enterprise policy → CLI flags → project settings → user settings → session grants → default deny. The 'bubble' mode is the primitive that matters. It lets a subagent escalate to its parent instead of prompting the user. UNIX process privilege inheritance, ported to agents.

Microsoft extended their AI agent failure taxonomy with 7 new attack categories past prompt injection: multi-turn context poisoning, tool-use exploitation via attacker-controlled parameters, capability escalation through chain-of-tool interactions, and persistence mechanisms surviving conversation boundaries.

For MCP Specifically

If a team has connected MCP servers exposing production credentials, internal APIs, or sensitive repos: the protocol layer itself is exploitable, not just the model's judgment. Restrict MCP servers to read-only access, no production credentials, scoped service accounts. Usage will outpace security review unless someone intervenes architecturally.