Miasma campaign poisons 20-plus NPM packages, hunts for developer secrets
A malicious campaign named Miasma has poisoned over 20 NPM packages, aiming to steal developer secrets such as API keys and credentials from infected systems. The supply-chain attack targets JavaScript developers by embedding obfuscated code that exfiltrates sensitive data to a remote server.
Background
- **NPM** (Node Package Manager) is the main registry where JavaScript developers download reusable code libraries. If attackers sneak malicious code into an NPM package, every project that installs it gets infected — a "supply-chain attack."
- **"Miasma"** is the name given to a campaign that poisoned 20+ NPM packages with code that steals developer secrets: API keys, database credentials, SSH keys, and cloud tokens harvested from environment variables and local files.
- Attackers used **typosquatting** (package names that look like popular ones, e.g. "sequelize" vs. the real "sequelize") and **dependency confusion** (registering a public package with the same name as a private internal package, so the package manager fetches the malicious public version instead).
- Developer secrets are a prime target because they often unlock production servers and cloud accounts. If a developer runs the poisoned code on their machine or in an automated build pipeline, the attacker silently captures those credentials.