Miasma Worm Hides Native Payload in GitHub Org Packages

What Happened

A self-replicating supply chain worm called Miasma has autonomously infected 73 Microsoft GitHub repositories across four organizations, and a variant (IronWorm) poisoned 50+ npm packages. This is not a targeted, manual package-poisoning attack. It is an autonomous worm that propagates across repositories, infecting their dependents automatically.

The campaign is described as 'ongoing' and not contained. If you have any npm dependencies pulled in the last week, you need to audit immediately.

Why Your Existing Defenses Are Blind

The payload is a Rust-based information stealer — a compiled native binary distributed through npm packages. This means:

• npm audit will not flag it (checks known CVEs, not binary payloads)
• JavaScript static analysis tools cannot inspect compiled Rust binaries
• Standard lockfile review won't catch postinstall scripts that download binaries at build time

Your exposure is transitive. The question isn't just "did I install a bad package" — it's "did any dependency in my tree pull from a compromised Microsoft repo in the last N days." If CI/CD auto-merges Dependabot PRs or uses floating version ranges for Microsoft packages, stop and audit now.

Detection Signatures

• Unexpected postinstall scripts that download binaries or make network calls
• New native files appearing in node_modules after recent updates
• Unexpected network connections during npm install or build phases
• CI run logs showing HTTP calls to unfamiliar endpoints

Architectural Response

This attack class — worms using package registries as propagation vectors — cannot be addressed by better lockfile hygiene alone. The defensive architecture needs:

1. Runtime behavioral monitoring in CI/CD: detect unexpected network calls and binary execution during install/build
2. Pinned checksums for all dependencies from Microsoft GitHub organizations
3. Network egress controls on build agents: allowlist only known registries and artifact stores
4. SBOM diffing on every PR that touches package.json or lockfiles

The Pattern

Four independent AI security failures landed this week. They look different at the surface. Underneath, they are the same bug: an LLM got write access to a system, and something talked it into using that access.

OpenAI's Lockdown Mode disables Deep Research and Agent Mode entirely. It does not harden them. That is the move you make once you have concluded prompt injection is not solvable at the model layer.

The Meta Exploit: A Conversation Was the Attack

F5 Labs disclosed that attackers hijacked high-profile Instagram accounts by asking Meta's AI chatbot to change the account email. The chatbot had write access to the identity system with no out-of-band verification. The model is a confused deputy by design. If it can call the privileged operation directly, someone will eventually talk it into doing so. The fix is not a better prompt. The fix is a second channel the model cannot forge.

The Hugging Face RCE: Your Config.json Is Executable

Hugging Face Transformers has 2.2 billion installs. If you run ML inference, it is almost certainly in your stack. The attack targets configuration files, not weights. Most teams treat config.json as inert metadata. It is not. The library instantiates objects based on config values, and an attacker embeds execution primitives in fields that look benign. GPU inference nodes are the prize: training data, model IP, cloud credentials, lateral network access.

Microsoft's 7 New Agent Failure Modes

Microsoft extended its AI agent failure taxonomy. Not new research. New categories. They are systematic and reproducible, and they sit beyond prompt injection: multi-turn context poisoning, tool-use exploitation, capability escalation through tool chains, and persistence across conversation boundaries. If your threat model stops at prompt injection, your threat model is incomplete.

The Architectural Fix

All four share one solution pattern:

1. The LLM proposes, a separate system authorizes. Cryptographic challenge, human approval, or deterministic policy gate. Never the LLM as final authority on state mutations.
2. Capability scoping at the tool layer, not the prompt layer. If a policy can be talked out of its decision in English, it is not a policy. It is another model.
3. Read-only by default. Mutations sit behind a deterministic layer the model cannot argue with.