Security · 1h ago
Miasma campaign poisons 20+ npm packages, targets developer secrets
Microsoft uncovered a supply chain attack dubbed Miasma that infected over 20 npm packages, including Leo Platform and RStreams. The malicious code harvests credentials and targets additional package maintainers. Developers are urged to audit their dependencies and rotate any exposed secrets.
Meridian48 take
The attack underscores the persistent vulnerability of open-source ecosystems, where trust in maintainers can be weaponized to compromise downstream users.
Read the full reporting
Miasma campaign poisons 20-plus npm packages, hunts for developer secrets →
The Register
supply-chain-attacknpm