Supply Chain Attack Artifacts in GitHub Repositories and Developer Machines (Miasma, Shai-Hulud, ForceMemo, Megalodon, GhostAction, TeamPCP and others)

Key facts for Miasma supply chain artifacts

Detection coverage for Miasma supply chain artifacts

As of 2026-11-04, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5205 across Splunk SPL, Microsoft KQL and Sigma, covering 30 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: Miasma .github/setup.js Loader Executed by Node.js or Bun - Exploitation

Detects node.exe/bun.exe executing the repository-supplied .github/setup.js, the ~4.6 MB obfuscated JavaScript credential harvester planted by Miasma (commit 5f456b8 on Azure/durabletask) and Mini Shai-Hulud. The payload fires when a poisoned folder is opened in Claude Code, Gemini CLI, Cursor or VS Code rather than at install time, so IDE/agent parentage raises severity to critical.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1195.002, T1059.007, T1546, T1027
• Data sources: sysmon, XmlWinEventLog:Microsoft-Windows-Sysmon/Operational, DeviceProcessEvents
• Severity: critical
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 earliest=-24h (Image="*node.exe" OR Image="*bun.exe") CommandLine="*.github*setup.js*"
```comment: Miasma / Mini Shai-Hulud loader - Node.js or Bun executing the repository-supplied .github/setup.js (about 4.6 MB single-line obfuscated JavaScript) after a folder is opened in VS Code, Cursor, Claude Code or Gemini CLI```
| eval ide_parent=if(like(lower(ParentImage),"%code.exe") OR like(lower(ParentImage),"%cursor.exe") OR like(lower(ParentImage),"%claude%") OR like(lower(ParentImage),"%gemini%"),"yes","no")
| stats count as exec_count min(_time) as first_seen max(_time) as last_seen values(CommandLine) as command_lines values(ParentImage) as parent_images values(ide_parent) as launched_by_ide_or_agent by host User Image
| eval severity=if(isnotnull(mvfind(launched_by_ide_or_agent,"yes")),"critical","high")
| convert ctime(first_seen) ctime(last_seen)
| table host User Image command_lines parent_images launched_by_ide_or_agent exec_count first_seen last_seen severity

Microsoft KQL

// Miasma .github/setup.js loader executed by Node.js or Bun (IDE / AI-agent autorun)
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("node", "node.exe", "bun", "bun.exe")
| where ProcessCommandLine matches regex @"(?i)[.]github.setup[.]js"
| extend LaunchedByIdeOrAgent = InitiatingProcessFileName in~ ("code", "code.exe", "cursor", "cursor.exe", "claude", "claude.exe", "gemini", "gemini.exe")
| project Timestamp, DeviceName, AccountName, FileName, FolderPath, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, LaunchedByIdeOrAgent, SHA256
| order by Timestamp desc

Sigma

title: Node.js or Bun Executing Repository .github/setup.js Loader
id: 3f6b2d1e-8a47-4c1d-9b52-1e7a5c0d4f01
status: experimental
description: Detects node or bun running a .github/setup.js file, the Miasma / Mini Shai-Hulud obfuscated credential-harvester loader that SessionStart hooks, VS Code folderOpen tasks and Cursor rules invoke when a poisoned repository is opened.
references:
  - https://www.stepsecurity.io/blog/malicious-files-find-what-supply-chain-attacks-leave-behind-in-your-github-repositories-and-on-developer-machines
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-04
tags:
  - attack.initial-access
  - attack.t1195.002
  - attack.execution
  - attack.t1059.007
  - attack.persistence
  - attack.t1546
logsource:
  category: process_creation
detection:
  selection_img:
    Image|endswith:
      - '/node'
      - '\node.exe'
      - '/bun'
      - '\bun.exe'
  selection_cli:
    CommandLine|contains:
      - '.github/setup.js'
      - '.github\setup.js'
  condition: all of selection_*
falsepositives:
  - Repositories that legitimately ship a .github/setup.js bootstrap script
  - Developers testing StepSecurity-style detection content
level: high

Known false positives:

• Repositories that legitimately ship a .github/setup.js bootstrap script run by a developer
• Security teams reproducing the StepSecurity miasma-ide-autorun-github-setup-js rule on a lab host

Tuning notes: Allow-list internal repositories that intentionally contain .github/setup.js by repo path. Keep the IDE/agent parent flag as the critical-severity discriminator. On macOS/Linux fleets run the KQL or Sigma variant against EDR process telemetry; Sysmon for Windows is the SPL source here.

• 🔒 Supply Chain Autorun Artifacts Planted in Repository (AI Agent Hooks, VS Code Tasks, setup.js, Megalodon Workflows) - Exploitation · unlock with TL Creds
• 🔒 Bun Staging, Runner.Worker Memory Scraping and Persistence on Developer/CI Hosts - Post-Exploitation · unlock with TL Creds
• 🔒 Script Interpreter Dead-Drop and Tunnel C2 (Solana, ICP, Cloudflare) - C2 · unlock with TL Creds
• 🔒 Malicious Package Install - axios plain-crypto-js and Hades PyPI Wheels - Exploitation · unlock with TL Creds
• 🔒 AI Coding CLI Abused with Permission-Bypass Flags from npm Lifecycle Script (s1ngularity) - Post-Exploitation · unlock with TL Creds
• 🔒 GitHub Exfiltration Repository Created (tpcp-docs, s1ngularity-repository) - C2/Exfiltration · unlock with TL Creds
• 🔒 Developer Machine Persistence and Staging Artifacts (TeamPCP, Miasma, ForceMemo) - Post-Exploitation · unlock with TL Creds
• 🔒 Egress to Supply Chain Campaign C2 and Exfiltration Infrastructure - C2/Exfiltration · unlock with TL Creds

Indicators of compromise for Miasma supply chain artifacts

As of 2026-11-04, Threadlinqs Intelligence tracks 30 indicators of compromise for TL-2026-5205.

Sample indicators (3 of 30)

• IP address: 216.126.225[.]129
• Domain: bold-dhawan[.]45-139-104-115[.]plesk[.]page
• File hash: c539766062555d47716f8432e73adbe3a0c0c954a0b6c4005017a668975e275c

Defanged, TLP:CLEAR. Full set of 30 indicators: unlock with TL Creds.

Community OSINT corroboration for Miasma supply chain artifacts

2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.

How Miasma supply chain artifacts works

This record consolidates a StepSecurity catalog (published 2026-11-03) of file-based artifacts that software supply chain campaigns leave behind in GitHub repositories, branches, pull requests, tags and on developer machines, together with primary-source reporting on each named campaign. The catalog is intended for hunting and detection: filename patterns (for example **/binding.gyp, **/.github/setup.js) combined with multi-check content analysis (StepSecurity rule miasma-ide-autorun-github-setup-js uses 5 checks, 3 required).

Miasma (Mini Shai-Hulud derivative): on 2026-06-05 a recompromised contributor account pushed commit 5f456b8 to Azure/durabletask with a backdated author timestamp (2020-03-09) and message 'Switched DataConverter to OrchestrationContext [skip ci]'. The commit changed no source code and added five files: .claude/settings.json and .gemini/settings.json (SessionStart hooks), .cursor/rules/setup.mdc (prompt injection), .vscode/tasks.json (folderOpen task) and .github/setup.js (a ~4.6 MB single-line obfuscated JavaScript credential harvester). The payload runs when the folder is opened in Claude Code, Gemini CLI, Cursor or VS Code, not at install time. It targets GitHub PATs and Actions secrets, npm/PyPI/RubyGems/JFrog/CircleCI/Anthropic tokens, AWS/GCP/Azure/Kubernetes/Vault credentials, .env, .npmrc, .pypirc, SSH keys and shell history, and uses Bun downloaded from GitHub releases as a runtime. Earlier Miasma waves (June 1 and June 4) delivered via npm preinstall and binding.gyp; a Hades wave on June 7 dropped 37 malicious wheels across 19 PyPI packages. GitHub disabled 73 Microsoft repositories in a ~2.5-minute sweep. Mini Shai-Hulud (May 2026) installs SessionStart and VS Code task persistence that survives reboots.

ForceMemo (GlassWorm offshoot): attackers use GitHub tokens stolen by GlassWorm-infected VS Code/Cursor extensions to take over accounts, rebase the latest commit with obfuscated malware appended to setup.py, main.py, app.py and similar files, and force-push while preserving the original message, author and date. The payload resolves its payload server via a Solana wallet memo (dead-drop resolver) and persists via ~/init.json.

Megalodon: on 2026-05-18 5,718 commits across 5,561 repositories in about six hours added or replaced GitHub Actions workflows (SysDiag.yml, Optimize-Build.yml, ci.yml) under forged build-bot identities; the payload gzips harvested CI secrets and cloud credentials and POSTs them to 216.126.225.129:8443/collect. Some workflows use workflow_dispatch to create dormant backdoors. GhostAction (disclosed 2025-09-05 by GitGuardian): 327 compromised accounts pushed a 'Github Actions Security' workflow to 817 repositories that exfiltrated 3,325 secrets to a plesk.page host. TeamPCP: on 2026-03-19 Trivy and trivy-action/setup-trivy were compromised after a pull_request_target misconfiguration leaked a PAT; the multi-stage stealer reads Runner.Worker process memory, encrypts with AES-256-CBC/RSA-4096 and exfiltrates to a typosquatted domain, with a tpcp-docs fallback repository and an ICP canister for secondary C2. Axios: axios@1.14.1 and axios@0.30.4 added the dependency plain-crypto-js@4.2.1 whose postinstall dropped a cross-platform RAT (Microsoft attributes to Sapphire Sleet). s1ngularity (Nx, 2025-08-26): malicious Nx versions ran telemetry.js, which abused installed AI CLIs (Claude, Gemini, Q) with permission-bypass flags to find secrets and published them to public s1ngularity-repository repositories.

No CVEs are assigned: these are account-takeover, CI misconfiguration and malicious-package campaigns (CWE-829, CWE-506). Attribution is campaign-specific and mostly low confidence; Miasma is linked to TeamPCP by a single vendor.

MITRE ATT&CK techniques by tactic:

Credential Access

T1003.007 Proc Filesystem; T1528 Steal Application Access Token; T1552.001 Credentials In Files

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.006 Timestomp

Execution

T1059.004 Unix Shell; T1059.006 Python; T1059.007 JavaScript

Command and Control

T1071.001 Web Protocols; T1102.001 Dead Drop Resolver

Initial Access

T1078 Valid Accounts; T1195.001 Compromise Software Dependencies and Development Tools; T1195.002 Compromise Software Supply Chain

Persistence

T1543.002 Systemd Service; T1546 Event Triggered Execution

Exfiltration

T1567 Exfiltration Over Web Service

Remediation for Miasma supply chain artifacts

Patches

• Upgrade Trivy beyond v0.69.4-v0.69.6 and use trivy-action/setup-trivy pinned to known-good SHAs
• Pin axios to 1.14.0 or 0.30.3 and remove plain-crypto-js@4.2.1
• Upgrade Nx beyond the compromised 20.9.0-20.12.0 and 21.5.0-21.8.0 ranges

Immediate actions

• Hunt repositories, branches, PRs, tags and developer machines for .claude/settings.json, .gemini/settings.json, .cursor/rules/setup.mdc, .vscode/tasks.json, .github/setup.js and binding.gyp additions that were not authored by your team
• Rotate every credential reachable from affected hosts or CI runs (GitHub PATs, Actions secrets, npm/PyPI/RubyGems tokens, cloud keys, SSH keys, DockerHub, Anthropic/AI API keys)
• Block IOC IPs and domains at the perimeter and search egress logs for them
• Search for the ForceMemo marker lzcdrtfxyqiplpd and commits whose committer date is much newer than the author date
• Review workflow files for SysDiag, Optimize-Build, 'Github Actions Security' and workflow_dispatch backdoors; check for tpcp-docs and s1ngularity-repository repositories in your accounts

Workarounds

• Do not open untrusted repositories in AI coding agents or VS Code without reviewing hook and task files first
• Treat any host that ran an affected package or workflow as compromised and rebuild from clean images

Longer-term hardening

• Pin GitHub Actions to full commit SHAs and enforce branch protection and signed commits to block force-push rewrites
• Disable or review AI coding agent hook auto-execution (Claude Code SessionStart, Gemini CLI, Cursor, VS Code workspace trust and folderOpen tasks) for untrusted repositories
• Use npm/PyPI install-script restrictions (ignore-scripts) and package cooldown policies; use short-lived OIDC credentials instead of long-lived tokens
• Avoid pull_request_target workflows that check out untrusted code
• Deploy runtime CI/CD and developer-machine monitoring for unexpected outbound connections

Affected and fixed versions

• GitHub — GitHub repositories and GitHub Actions workflows
  Vulnerable versions: Repositories with weak branch protection or compromised contributor tokens
• Microsoft — Azure/durabletask and 73 Microsoft-owned repositories (Miasma)
  Vulnerable versions: Clones opened after 2026-06-02 in Claude Code, Gemini CLI, Cursor or VS Code
• Aqua Security — Trivy, trivy-action, setup-trivy
  Vulnerable versions: Trivy v0.69.4, v0.69.5, v0.69.6; 75 of 76 trivy-action tags; 7 setup-trivy tags
• axios — axios (npm)
  Vulnerable versions: 1.14.1; 0.30.4
  Fixed in: 1.14.0; 0.30.3
• Nx — nx (npm)
  Vulnerable versions: 20.9.0-20.12.0; 21.5.0-21.8.0
• PyPI — Hades wave packages (dynamo-release, spateo-release, coolbox, ufish, napari-ufish and others)
  Vulnerable versions: dynamo-release 1.5.4; spateo-release 1.1.2; coolbox 0.4.1-0.4.2; ufish 0.1.2-0.1.3; napari-ufish 0.0.2-0.0.3
• Anthropic / Google / Cursor / Microsoft — Claude Code, Gemini CLI, Cursor, VS Code (auto-execution of workspace hook and task files)
  Vulnerable versions: Configurations that auto-run repository-supplied hooks or folderOpen tasks

Timeline of Miasma supply chain artifacts

• 2025-08-26 Malicious Nx versions published to npm via a flawed GitHub Actions workflow; telemetry.js stole secrets and used AI CLIs to hunt credentials, publishing them to s1ngularity-repository repos.
• 2025-09-05 GitGuardian discloses GhostAction: 327 compromised accounts, 817 repositories, 3,325 secrets exfiltrated; exfil host stopped resolving at 16:15 UTC.
• 2026-03-08 First ForceMemo GitHub repository injections detected; major waves on March 10 and 13.
• 2026-03-14 StepSecurity publicly discloses ForceMemo; some repositories begin reverting.
• 2026-03-19 TeamPCP injects credential stealer into Trivy and trivy-action/setup-trivy (initial compromise 17:43 UTC); four-wave campaign through March 24 also hits Checkmarx KICS and LiteLLM.
• 2026-03-30 axios@1.14.1 and axios@0.30.4 published after maintainer account takeover, adding locked-ioc-15 that drops a cross-platform RAT; removed after about 2-3 hours.
• 2026-05-18 Megalodon pushes 5,718 commits to 5,561 repositories between about 11:36 and 17:48 UTC, adding backdoored GitHub Actions workflows that exfiltrate CI secrets.
• 2026-05-19 Malicious durabletask PyPI versions 1.4.1-1.4.3 live for about 35 minutes, preceding the Miasma wave.
• 2026-06-01 Miasma wave 1 compromises 32 @redhat-cloud-services npm packages via preinstall delivery.
• 2026-06-04 Miasma wave 2 compromises 57 npm packages using binding.gyp delivery.
• 2026-06-05 Backdated commit 5f456b8 to Azure/durabletask plants Claude Code, Gemini CLI, Cursor, VS Code autorun files and locked-ioc-18; GitHub disables 73 Microsoft repositories in a sweep starting about 16:00 UTC.
• 2026-06-07 Hades wave drops 37 malicious wheels across 19 PyPI packages.
• 2026-11-03 StepSecurity publishes a catalog of malicious files left in repositories and on developer machines with detection rules, including miasma-ide-autorun-github-setup-js.

Sources cited for Miasma supply chain artifacts

• RH-ISAC: Axios npm Package Compromised to Deliver Remote Access Trojan rhisac.org · Advisory · 2026-03-31
• Phoenix Security: Miasma Worm Reaches Microsoft Azure and PyPI - 73 Repositories Disabled, Hades Wave Drops 37 Malicious Python Wheels phoenix.security · Research · 2026-06-07
• GitGuardian: GhostAction Campaign - 3,325 Secrets Stolen blog.gitguardian.com · Research · 2025-09-05
• Wiz: Trivy Compromised - Everything You Need to Know about the Latest Supply Chain Attack (TeamPCP) Wiz · Vendor report · 2026-03-20
• Cloud Security Alliance: TeamPCP CI/CD Security Tool Supply Chain Compromise labs.cloudsecurityalliance.org · Research · 2026-03-25
• StepSecurity: Malicious Files - Find What Supply Chain Attacks Leave Behind in Your GitHub Repositories and on Developer Machines stepsecurity.io · Blog · 2026-11-03
• StepSecurity: Megalodon - Mass GitHub Actions Secret Exfiltration Across 5,500 Public Repositories stepsecurity.io · Blog · 2026-05-18
• StepSecurity: ForceMemo - Hundreds of GitHub Python Repos Compromised via Account Takeover and Force-Push stepsecurity.io · Blog · 2026-03-14
• Hive Security: Miasma and Mini Shai-Hulud AI agent supply chain 2026 hivesecurity.gitlab.io · Blog · 2026-06-08
• DEV Community: 639 npm packages compromised in 39 minutes - malware installs a Claude Code SessionStart hook dev.to · Blog · 2026-05-20
• StepSecurity: GhostAction Campaign - Over 3,000 Secrets Stolen Through Malicious GitHub Workflows stepsecurity.io · Blog · 2025-09-05
• SecurityWeek: Over 5,500 GitHub Repositories Infected in Megalodon Supply Chain Attack SecurityWeek · News · 2026-05-19
• The Hacker News: GlassWorm Attack Uses Stolen GitHub Tokens (ForceMemo) The Hacker News · News · 2026-03-16
• BleepingComputer: Trivy vulnerability scanner breach pushed infostealer via GitHub Actions BleepingComputer · News · 2026-03-20
• BleepingComputer: AI-powered malware hit 2,180 GitHub accounts in s1ngularity attack BleepingComputer · News · 2025-09-01

More in supply chain

• PolinRider Loader Reappears in Hijacked npm Packages (12 malicious releases across 10 packages)
• NIKKE PC Game Launcher CDN Compromise Delivers K2F Remote Access and Data-Stealing Malware
• Malicious cPGuard Updates Served in OpsShield Supply Chain Attack (Update CDN Compromise, cPGuard 5.88.12-5.88.19)
• Binance Wallet Infrastructure Compromise via Fake Job Interviews, Trojanized Homebrew Installer and Internal AI Tool Abuse (~$6.3B Theft, TraderTraitor)
• cPGuard Update Channel Hijacked to Backdoor Linux Servers and Collect Password Hashes (OPSSHIELD Supply-Chain Compromise)

Related coverage of this activity

• GhostAction workflow malware

Further reading

• TeamPCP Supply Chain Attack on Trivy, LiteLLM
• Axios Supply Chain Attack: Cross-Platform RATs
• npm Supply Chain Attacks 2026: 218 Packages