Miasma npm Worm Spreads Unseen Past npm audit Checks

The npm Worm That Spreads Itself

The Miasma worm is not just another malicious npm package. It's a self-replicating campaign that propagates autonomously across repositories with no human in the loop. It has hit 73 Microsoft GitHub repos across four organizations. A variant called IronWorm poisoned 50+ additional npm packages. The payload is a Rust-based information stealer, a compiled native binary that will not show up in JavaScript static analysis. The npm audit is blind to this.

The relevant question is not whether you installed a bad package directly. It is whether any transitive dependency pulled from a compromised Microsoft repo in the last N days. The campaign is ongoing and not contained.

Compromised repos infect their dependents automatically. If you auto-merge Dependabot PRs or float version ranges for Microsoft packages, you are in the blast radius. The signals worth grepping for are postinstall scripts downloading binaries, unexpected network calls during builds, and new native files appearing in node_modules.

ML Model Configs Are Now an RCE Vector

Hugging Face Transformers (2.2 billion installs) has a critical RCE reachable through model configuration files. The vector is config, not weights. Most teams already harden against pickle deserialization in weights, but nobody treats config.json as executable input. It is. The library evaluates or instantiates objects based on config values, which gives an attacker execution primitives in what looks like benign metadata.

The targeting is deliberate. GPU inference nodes typically hold training data access, model IP, cloud credentials, and lateral paths into ML infrastructure. In my context, anything calling from_pretrained() against an untrusted artifact runs in an isolated sandbox with minimal privileges and no network egress. If you are loading models you don't fully control from a request handler, do not do that.

The Meta-Signal: AI-Powered Discovery at Scale

An AI agent autonomously found 21 zero-day vulnerabilities in FFmpeg. FFmpeg is the media processing substrate of the internet, sitting under your video pipeline, thumbnail generator, browser, and mobile app. Similar agents are now being pointed at every foundational C/C++ library. In my context I am budgeting for 5-10x the patch velocity we planned for last year. The vulnerability management process most teams run was not designed for that throughput.

Meta's Chatbot Was the Attack Surface

Attackers took over high-profile Instagram accounts by asking Meta's AI chatbot to change the account email. The chatbot had write access to the identity system. No out-of-band verification on the path. This was not prompt injection in the classic sense. The model did exactly what it was authorized to do. The exploit was a conversation. The model is a confused deputy by construction.

If the policy can be talked out of its decision in English, it is not a policy. It is another model.

The right shape: the LLM proposes, a separate deterministic system authorizes via cryptographic challenge, human approval, or MFA. The LLM is never the final authority on identity changes, financial transactions, or credential mutations. This is the same lesson as never letting the requester sign their own capability token.

OpenAI Concedes: Lockdown Mode Disables, Doesn't Harden

OpenAI shipped Lockdown Mode. Read the spec. It disables Deep Research, Agent Mode, web image fetching, and file downloads entirely. It does not make them safer. It turns them off. The industry leader, with the largest red team and the most telemetry, is declining to defend agents that touch the open web.

The implication is direct. If a system ingests documents from the internet, parses email, or runs user-uploaded files through an LLM that also holds tool-calling, it has the exact vulnerability OpenAI just conceded they cannot fix. Prompt injection is a property of the architecture, not a bug in the build.

MCP Protocol Itself Is Exploitable

Claude Code's MCP (Model Context Protocol) has a vulnerability in the protocol layer itself. This is not Claude being talked into bad behavior. The integration mechanism is exploitable on its own terms. Developers wiring up MCP servers that expose production credentials, internal APIs, or repositories hand attackers that access without anyone compromising the developer's machine. Microsoft published 7 new attack vectors for AI agents the same week, all extending past prompt injection.

The Architectural Pattern to Adopt