What is Miasma?
It appears to be an upgraded variant of the Shai-Hulud lineage. If you have been keeping up with TeamPCP and their malware, you likely saw this variant coming. For those not in the know, TeamPCP open-sourced the full Shai-Hulud malware code base on GitHub, inviting people from around the globe to copy their homework. How nice of them.
Miasma appears to be the first major evolution to spawn from this homework. It's impressive and features tricks like:
- Unique Encryption: Earlier Shai-Hulud variants copied themselves byte-for-byte. Miasma encrypts itself uniquely on every single infection, making it much harder for traditional antivirus scanners to catch it using file hashes.
- Targeting Cloud Identities: Instead of just grabbing static, long-lived API keys like the older versions, Miasma seeks active GCP and Azure cloud identities right from the infected machine's metadata.
The "Phantom Gyp" Trick
Security tools usually flag malicious scripts in package.json. Miasma bypassed this completely. It hid inside a 157-byte file named binding.gyp, which is normally used to compile C++ add-ons.
The moment a developer typed npm install, the Node.js build engine executed a hidden 4.5MB malware payload.
Squatting in AI Tools
Miasma ensures persistence, and searches the infected machine for configuration files belonging to modern developer tools and AI assistants.
It injects malicious code directly into:
Cursor AI (
.cursor/rules/setup.mdc)Claude Code (
.claude/settings.json)Gemini CLI (
.gemini/settings.json)VS Code tasks (
.vscode/tasks.json)
Even if a developer deletes the bad npm package, the malware wakes back up every time they use their code editor or AI assistant. Clever.
Drama: Hijacking Red Hat
The attackers (a group called TeamPCP) compromised a Red Hat employee's GitHub account. They bypassed branch protections to push code.
They used the repository's official GitHub Actions to request npm publish rights. Because the official pipeline built the software, the malware shipped with a legitimate, cryptographically verified trust badge (SLSA provenance). In short, this means they could ship the malware in an official looking package.
A Mark Left Behnd
The attackers used GitHub against itself. When Miasma stole cloud credentials, it automatically created a new public GitHub repository under the victim's account and uploaded the stolen data there as JSON files.
The group also mocked cybersecurity researchers. Many of these public leak repositories contained a strange description string: "niagA oG eW ereH :duluH-iahS". Read backward, it spells: "Shai-Hulud: Here We Go Again"—a direct reference to the sandworms in the sci-fi novel Dune.
A Failsafe
Miasma contains a defensive tripwire. The creators planted fake credentials (decoy tokens) inside the code. If a security researcher or automated sandbox tries to test or modify these tokens, the malware triggers an rm -rf command. Why? Just out of spite, we reckon!
A Flood is Coming
I mentioned earlier that Miasma is the first major product of TeamPCP releasing the blueprint to their successful Shai-Hulud worm.
We will likely see dozens of new variants that will use the same self-spreading worm logic but swap out the themes, obfuscation methods, and targeted developer tools to stay ahead of antivirus signatures. Moreover, Security teams are already panicking over the "Phantom Gyp" trick.
Will organizations start aggressively blocking traditional preinstall and postinstall lifecycle scripts in their .npmrc configurations using --ignore-scripts. How feasible is that? Onecannot easily block binding.gyp because it is required to compile essential native Node modules. Security tools will have to reinvent how they scan C/C++ build configurations inside packages. But can they? Only time will tell...many such cases indeed.
All we can do is prepare and ready ourselves for the next big wave!