Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub (Shai-Hulud / Mini Shai-Hulud Variant) — Threadlinqs Intelligence
As of 2026-06-09, Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub (Shai-Hulud / Mini Shai-Hulud Variant) is a critical-severity supply chain threat attributed to TeamPCP, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 35 indicators of compromise.
Threat ID: TL-2026-0736 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: TeamPCP · FINANCIAL
Miasma is a full-spectrum, open-sourced supply chain attack toolkit publicly released on GitHub on June 8, 2026 via four previously compromised developer accounts. Derived from TeamPCP's Mini
Miasma is a TypeScript/Bun supply chain attack platform that an operator runs to compromise open-source package ecosystems at scale using stolen credentials. SafeDep, Socket, and Wiz Research independently analyzed the toolkit after a wave of malicious package publications, most notably the trojanizing of @redhat-cloud-services npm packages (~80,000 weekly downloads) traced to a compromised Red Hat employee GitHub account acting as patient zero. Socket's campaign tracker recorded 471 affected artifacts: 411 npm artifacts across 106 packages and 60 PyPI artifacts across 37 packages.
The malware operates entirely within GitHub's infrastructure, using three independent unauthenticated GitHub public commit-search channels as command-and-control: 'DontRevokeOrItGoesBoom' discovers attacker-controlled Personal Access Tokens (PATs) for credential exfiltration (tokens encrypted with AES-256-CBC and an embedded AES key, then enveloped under an RSA-4096 public key), 'TheBeautifulSandsOfTime' delivers base64-encoded JavaScript executed in-memory via eval() for immediate command execution, and 'firedalazer' delivers Python script URLs for a persistent monitor with RSA-PSS signature verification. Each channel uses independent validation/decryption keys to prevent cascading compromise, and a backup channel ('thebeautifulmarchoftime') is present but unwired in the analyzed build.
The attack chain begins at install time. Trojanized npm packages execute via preinstall scripts that invoke a malicious index.js, or via a binding.gyp 'sources' trick ('node index.js > /dev/null 2>&1 && echo stub.c') introduced in the June 4 wave to bypass npm's ignore-scripts protections. A self-extracting payload uses a three-layer scheme (ROT-N outer shell, AES-128-GCM Bun-guard section, AES-128-GCM payload section) and pins Bun v1.3.13. PyPI delivery uses three branches: malicious .pth startup hooks with bundled payloads, trojanized .abi3.so native extensions, and .pth loaders that search sys.path for an external _index.js. Typosquatting uses '-mcp' and '-mpc' suffixes targeting MCP/AI and bioinformatics developers.
Post-exploitation, Miasma harvests GitHub Actions secrets, npm tokens, SSH and Git credentials, and cloud identities (AWS SSM/Secrets Manager, plus new GCP and Azure collectors), Kubernetes, HashiCorp Vault, and password-manager material (1Password, Bitwarden). On GitHub Actions runners it dumps /proc memory for secrets not exposed as env vars and abuses ACTIONS_ID_TOKEN_REQUEST_URL to mint OIDC tokens, then publishes trojanized packages with valid Sigstore/SLSA provenance attestations via branch-mutator and deployment-environment bypass tricks. It performs AWS SSM lateral movement across 17 regions in parallel and SSH-based propagation. Each infection generates a uniquely encrypted payload, rendering hash-based IOCs useful only per package version. The malware checks for EDR (CrowdStrike Falcon, SentinelOne, Microsoft Defender, Carbon Black, Cylance, Trend Micro, Trellix, osquery, Tanium, Qualys), targets StepSecurity Harden-Runner, avoids execution on Russian-language systems, and ships a dead-man switch that wipes the victim home directory (rm -rf ~/) if the stolen PAT is revoked. AI tool poisoning targets Claude Code, Gemini CLI, Cursor, GitHub Copilot, VSCode and others via SessionStart hooks, folderOpen tasks, and rule injection. Attribution is consistent with TeamPCP (tracked as TGR-CRI-1135 / UNC6780 / Replicating Marauder), but because TeamPCP open-sourced the tooling, a copycat actor cannot be ruled out.
Weaknesses (CWE)
CWE-506, CWE-829, CWE-494, CWE-1357, CWE-522, CWE-78
Target sectors: technology, software development, open-source ecosystems, cloud services, bioinformatics, healthcare research, financial
Target regions: North America, Europe, Global
Detections & IOCs
As of 2026-07-21, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 35 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1586, T1608, T1587, T1195, T1195, T1078, T1059, T1059, T1059, T1053