Miasma Worm Campaign Escalates to AsyncAPI npm Trusted-Publisher Compromise, Continuing Direct Targeting of AI Coding Agent Configs

Building on a campaign already flagged as one of 2026's most consequential (StepSecurity, Semgrep, Tenable), the Miasma malware family — a Mini Shai-Hulud derivative — escalated on July 14, 2026 to compromise AsyncAPI's npm namespace via a legitimate trusted-publisher pipeline, and separately continued its established technique (documented by Tenable and StepSecurity, actively discussed July 21-23, 2026) of directly weaponizing AI coding agent configuration surfaces (Claude Code hooks, Cursor rules, Gemini CLI settings, VS Code tasks) for automatic, silent malicious execution the instant a developer opens an infected repo in an AI-assisted IDE.

This is the clearest evidence yet of attackers treating the AI coding agent's own configuration and hook surface as a first-class initial-access vector, on par with npm install scripts — meaning that trust in signed/provenance-attested packages, and even in reputable upstream repos, no longer guarantees safety once an AI agent auto-executes hook-triggered code. Any organization using Claude Code, Cursor, Gemini CLI, GitHub Copilot, or similar tools on a compromised or malicious repo is at risk of silent credential theft, persistence, or destructive 'death switch' payloads with zero required user interaction beyond opening the project.

Attacker obtained push access to the asyncapi/generator repository's next branch and abused the project's own legitimate GitHub Actions release workflow plus npm's OIDC trusted-publisher integration to produce malicious releases with valid SLSA provenance. The injected dropper executes on require() (not install), launching a detached Node.js process that fetches an encrypted second-stage Miasma v3 payload from IPFS, harvesting GitHub/npm/PyPI/AWS/Kubernetes/SSH/browser/macOS Keychain credentials. In prior/parallel waves of the same campaign, attackers directly modified AI coding agent configuration/rules files (SessionStart hooks, Cursor alwaysApply rules, VS Code folderOpen tasks) so that malicious code auto-executes the moment a developer opens a repo in Claude Code, Gemini CLI, Cursor, GitHub Copilot, ChatGPT Codex, Cline, or Aider — turning the AI-agent harness itself into the payload trigger.

npm ecosystem packages (@asyncapi/generator and related, versions with malicious releases through July 14 2026); AI coding agent harness config files: .claude/settings.json, .gemini/settings.json, .cursor/rules/setup.mdc, .vscode/tasks.json across any repo attacker can push to

Rotate all GitHub, npm, PyPI, cloud, and SSH credentials on any system that imported affected AsyncAPI packages; audit repositories for unexpected .claude/.gemini/.cursor/.vscode config changes; pin lockfiles to pre-compromise versions; treat provenance/SLSA attestation as necessary but not sufficient — enforce build-time behavioral policy, not just publish-time signature checks.