Miasma Worm Spreads via npm Postinstall Compiled Binaries

The Miasma Campaign Is Qualitatively Different

This is not another malicious npm package. Miasma is a self-replicating worm that propagates autonomously across repositories. It compromised 73 Microsoft GitHub repos across four organizations and, together with the IronWorm variant, poisoned 50+ npm packages. The payload is a Rust-based information stealer — a compiled native binary that will not appear in JavaScript static analysis tools. Your npm audit is blind to this. The campaign is described as ongoing and not contained.

Your exposure isn't 'did I install a bad package' — it's 'did any of my transitive dependencies pull from a compromised Microsoft repo in the last N days.'

The attack pattern exploits automated dependency workflows. If your CI/CD auto-merges Dependabot PRs or uses floating version ranges for Microsoft packages, you're in the blast radius. Look for: postinstall scripts that download binaries, unexpected network connections during builds, new native files in node_modules.

AI Is Now the Vulnerability Discovery Engine

An AI agent from a security startup found 21 zero-day vulnerabilities in FFmpeg — the media processing substrate of the internet. FFmpeg is in your video transcoding pipeline, your thumbnail generator, your browser. Simultaneously, Hugging Face Transformers (2.2 billion installs) has an RCE exploitable through model configuration files — not weights, not pickle, but config.json. Most teams treat this as safe data. It isn't.

The meta-signal: AI-powered vulnerability discovery is production-real. Similar agents are being pointed at every foundational C/C++ library. Expect 5-10x the zero-day disclosure velocity you've planned for. Anthropic expanded Project Glasswing to 150+ companies. Infosecurity Europe warned about next-gen models ('son of Mythos'). The structural gap where discovery outpaces patching is now permanent.

Defense Architecture

The correct response is not 'patch faster.' It's assume compromise and contain blast radius:

• Process untrusted media in isolated sandboxes (gVisor, Firecracker microVMs) with no network egress
• Run from_pretrained() against any model you don't fully control in containers with minimal privileges
• Add runtime behavioral monitoring to CI/CD — detect unexpected network calls and binary execution during npm install/build
• Supplement NVD (backlog growing, no strategic plan) with OSV.dev and GitHub Advisory Database
• Default-deny NetworkPolicies in Kubernetes — a compromised dependency cannot pivot laterally

A Week of Vendor Concessions on Agent Security

Meta's AI chatbot was social-engineered into changing account emails on high-profile Instagram accounts. The LLM had direct write access to the identity system with no out-of-band verification. There was no memory bug or forged token; attackers convinced the model to perform an action it was already authorized to perform.

OpenAI shipped Lockdown Mode, which disables Deep Research, Agent Mode, web image fetching, and file downloads outright. It does not harden these surfaces; it removes them. The vendor with the largest red team and the most telemetry is declining to defend agents that touch the open web.

Claude Code's MCP protocol has a security flaw under active exploitation against developers. The bug is in the integration mechanism, not in prompt injection, which means it is exploitable regardless of the model's refusal behavior.

If the policy can be talked out of its decision in English, it is not a policy. It is another model.

Why This Keeps Happening

The pattern is identical across all three. An LLM is a confused deputy by construction: it treats instructions and data as the same tokens, and its refusal behavior is a learned distribution rather than a permission boundary. Treating refusal as access control is a category error. The auth system does not know it is talking to a model. It sees a service principal with scopes, and the scopes were broad.

Microsoft published 7 new failure modes specific to AI agents, extending the prior taxonomy past prompt injection: multi-turn context poisoning, tool-use exploitation with attacker-controlled parameters, capability escalation through tool chains, and persistence across conversation boundaries.

The Fix: Claude Code's 7-Tier Model as Reference Architecture

Anthropic's Claude Code ships a graduated permission ladder. It is the best working example I have seen of capability-based security for AI agents:

The critical design choice: the LLM proposes, a separate system authorizes. Mutations sit behind a deterministic policy layer the model cannot argue with. The 'bubble' mode is the escape hatch, promoting an operation back up the chain mid-run so the agent does not hit the all-or-nothing trap.