A persistent malware campaign known as Miasma has undergone a significant evolution, shifting its focus from poisoning software packages to directly hijacking the CI/CD automation pipelines that developers rely on. This escalation, observed in recent attacks targeting npm and GitHub Actions, represents a more direct and damaging threat to the software development process itself.
Security analysis confirms the campaign, also tracked under aliases including Mini Shai-Hulud and Hades, now actively abuses GitHub Actions workflows. The latest activity includes malicious npm releases affecting the LeoPlatform and RStreams packages, with at least 23 npm packages compromised in total. Instead of solely inserting malicious code into published packages for consumers to install, attackers are compromising repositories to execute code within GitHub's own build environments. This grants them the potential to steal secrets, access source code, and gain a foothold for lateral movement within an organization's network.
This marks a tactical shift from targeting the supply chain's consumers to corrupting its production infrastructure. Such pipeline compromises can inject backdoors directly into compiled binaries before they are ever distributed, fundamentally breaching software integrity.
Beyond npm and GitHub, researchers have identified the same threat actors compromising modules within the Go ecosystem, including the Verana package. This expansion across multiple developer communities—npm, GitHub Actions, and Go—points to a coordinated and strategic campaign aimed at maximizing its impact.
For development teams, this evolution demands an immediate broadening of security vigilance. CI/CD pipelines and developer automation tools must now be treated as critical attack surfaces on par with dependency management.
Key security recommendations include: * Audit and Lock Down Workflows: Scrutinize all existing GitHub Actions workflows. Remove or strictly limit the use of untrusted third-party actions. * Enforce Least Privilege: Grant CI/CD systems and automation bots access only to the absolute minimum resources required for their function. * Monitor Actively: Implement regular auditing of repository access logs and workflow executions to detect anomalous activity. * Extend Vigilance: Apply the same security rigor to the Go module ecosystem as is applied to npm, PyPI, and other package repositories.
The Miasma campaign demonstrates an adaptive adversary that is evolving its tactics. As development workflows become more automated and centralized, securing the integrity of those automated pipelines is no longer optional but a core requirement of modern application security.
一個名為 Miasma 的持續惡意軟件活動已發生重大演變，其關注點從污染軟件套件轉向直接劫持開發者所依賴的 CI/CD 自動化管道。在近期針對 npm 和 GitHub Actions 的攻擊中觀察到的此次升級，對軟件開發過程本身構成了更直接且具破壞力的威脅。
安全分析證實，該活動（亦以 Mini Shai-Hulud 和 Hades 等別名被追蹤）現在積極濫用 GitHub Actions 工作流程。最新的活動包括針對 LeoPlatform 和 RStreams 套件的惡意 npm 發布，總計至少有 23 個 npm 套件被入侵。攻擊者不僅僅是在已發布的套件中植入惡意代碼供消費者安裝，更入侵儲存庫以在 GitHub 自身的構建環境中執行代碼。這使他們有能力竊取密鑰、訪問原始碼，並為在組織網絡內進行橫向移動奠定基礎。
此舉標誌著戰術轉變：從針對供應鏈的消費者轉向腐蝕其生產基礎設施。此類管道入侵可在二進制檔案分發前直接植入後門，從根本上破壞軟件完整性。
除了 npm 和 GitHub，研究人員發現相同的威脅行為者已入侵 Go 生態系統中的模組，包括 Verana 套件。這種跨越多個開發者社群（npm、GitHub Actions 和 Go）的擴展，指向一項協調一致且具戰略性的活動，旨在最大化其影響範圍。
對開發團隊而言，此演變要求立即擴大安全警戒範圍。CI/CD 管道和開發者自動化工具現在必須被視為與依賴管理同等重要的關鍵攻擊面。
關鍵安全建議包括： * 審核並鎖定工作流程： 嚴格審查所有現有的 GitHub Actions 工作流程。移除或嚴格限制使用不受信任的第三方 Actions。 * 實施最小權限原則： 僅授予 CI/CD 系統和自動化機器人完成其功能所需的絕對最少資源訪問權限。 * 主動監控： 定期審計儲存庫訪問日誌和工作流程執行記錄，以偵測異常活動。 * 擴大警戒範圍： 對 Go 模組生態系統應用與 npm、PyPI 及其他套件儲存庫相同的安全嚴謹度。
Miasma 活動展示了一個能適應的對手，其正在演進其戰術。隨著開發工作流程變得更加自動化和集中化，確保這些自動化管道的完整性不再是可選項，而是現代應用程式安全的核心要求。