Miasma Worm Spreads via Dependabot Auto-Merge in CI/CD

The Threat Has Changed Shape

Supply chain attacks just graduated from manual package poisoning to autonomous propagation. The Miasma worm compromised 73 Microsoft GitHub repositories across four organizations, then a variant plus the IronWorm campaign poisoned 50+ npm packages. The payload is a Rust-based information stealer — a compiled native binary that JavaScript static analysis tools, including npm audit, cannot detect. Your standard security tooling is blind to this.

The campaign is described as 'ongoing' and not contained. If you auto-merge Dependabot PRs or use floating version ranges for Microsoft packages, your CI pipeline may already be compromised.

Why This Is Different From Previous npm Incidents

Previous supply chain attacks (ua-parser-js, event-stream) required a human attacker to manually compromise a maintainer account and publish a malicious version. Miasma propagates autonomously — compromised repos infect their dependents without human intervention. Your exposure isn't just "did I install a bad package" — it's "did any of my transitive dependencies pull from a compromised Microsoft repo in the last N days."

Compounding Factor: AI-Accelerated Discovery

In the same week, an AI agent from an unnamed security startup found 21 zero-day vulnerabilities in FFmpeg. FFmpeg is the media processing substrate of the internet — transcoding pipelines, thumbnail generators, browsers, mobile apps. Separately, Anthropic expanded Project Glasswing to 150+ companies, and speakers at Infosecurity Europe warned about next-gen models that will accelerate discovery further.

The structural implication is concrete: AI finds vulnerabilities faster than humans patch them. Your patch-when-available strategy now has a permanently growing exposure window you cannot shrink by waiting. The Cisco Catalyst SD-WAN Manager vulnerability (CVE-2026-20245, CVSS 7.8) is the existence proof — actively exploited, zero patches available.

Parallel Attack Surface: Model Configs as RCE Vectors

Hugging Face Transformers (2.2B installs) has a critical RCE exploitable through model configuration files. Most teams treat config.json as safe metadata. It isn't. If the library instantiates objects based on config values, attackers embed execution primitives in what looks like hyperparameters. GPU inference nodes are high-value targets with access to training data, model IP, and cloud credentials. Anyone calling from_pretrained() against untrusted sources needs isolation immediately.

Defense Architecture

• Immediate: Audit npm lockfiles against known-bad package lists. Look for unexpected postinstall scripts or native binary downloads.
• This sprint: Add runtime behavioral monitoring to CI/CD — detect unexpected network calls and binary execution during npm install/build.
• Architecture: Process untrusted media and untrusted models in isolated sandboxes (gVisor, Firecracker). Default-deny NetworkPolicies.
• Compensating controls: RASP, virtual patching via WAF, aggressive network segmentation between services.

OpenAI Lockdown Mode: capability removal as defense

OpenAI shipped Lockdown Mode. Read the spec, not the announcement. It disables Deep Research, Agent Mode, web image fetching, and file downloads entirely. It does not harden them. The switch is off. This is the largest AI lab, with the most red-teaming telemetry, concluding that the only reliable defense against prompt injection is capability removal.

If the best-resourced lab won't defend agents that touch the open web, the signal isn't the blog post. It's the kill switch they shipped, and you are building on the same primitives.

Meta's chatbot: confused deputy, made concrete

F5 disclosed that Meta's AI chatbot was socially engineered into changing account emails on high-profile Instagram accounts. The exploit wasn't a memory bug or a forged token; it was a conversation that the chatbot was allowed to act on. The model held write access to the authentication system, and no out-of-band verification existed on that write path.

This is the confused deputy problem made concrete. The LLM is a probabilistic function over text. Its refusal behavior is a learned distribution, not a permission boundary. The auth system sees a service principal with scopes, and the scopes were broad.

Claude Code MCP: the developer tool attack surface

Claude Code's MCP (Model Context Protocol) has a security vulnerability being actively exploited. The problem is in the protocol layer itself. This is not prompt injection making Claude misbehave; it is the integration mechanism being exploitable. If engineers connected MCP servers exposing production credentials, internal APIs, or sensitive repos, an attacker exploiting this flaw gets that access without compromising the developer's machine.

Microsoft's publication of 7 new AI agent failure modes extends their taxonomy beyond prompt injection into multi-turn context poisoning, tool-use exploitation with attacker-controlled parameters, capability escalation through tool chains, and persistence across conversation boundaries.

The architectural fix

The rule: If a policy can be talked out of its decision in English, it is not a policy. It is another model.