The Reveal Platform
Software supply-chain attacks have evolved from isolated package compromises into highly automated campaigns capable of targeting entire developer ecosystems. Recent activity associated with the Shai-Hulud cluster demonstrates this progression through a series of campaigns focused on credential theft, repository compromise, CI/CD abuse, and malicious package publication.
Early Shai-Hulud activity primarily relied on malicious npm packages and on compromises of GitHub repositories. Subsequent campaigns, commonly referred to as Mini Shai-Hulud, expanded the focus toward large-scale credential harvesting targeting GitHub Personal Access Tokens (PATs), package registry credentials, SSH keys, cloud secrets, and CI/CD tokens. More recently, the public release of the Miasma source code provides insight into how these techniques can be consolidated into a modular framework that operates across multiple software ecosystems.
This report examines the evolution of these campaigns and provides a technical analysis of Miasma’s architecture, credential-harvesting capabilities, propagation mechanisms, and the abuse of modern development infrastructure.
Throughout this report, the term “Shai-Hulud activity cluster” refers to campaigns that share operational characteristics and targeting patterns. While notable similarities exist, direct attribution between all incidents discussed remains unconfirmed unless explicitly stated.
Shai-Hulud represented a notable shift from traditional malicious package campaigns by targeting both developer workstations and GitHub repositories. The malware focused on harvesting GitHub credentials, modifying repositories, and injecting malicious GitHub Actions workflows that enabled automated execution of attacker-controlled code.
Through GitHub Actions workflow abuse, the campaign leveraged trusted CI/CD infrastructure to establish persistence and facilitate propagation across downstream repositories.
The broader activity cluster also shares characteristics with large-scale GitHub Actions compromises such as Megalodon, which targeted thousands of repositories through malicious workflow injections designed to harvest secrets and CI/CD credentials.
Observed incident shared operational characteristics with this approach:
Megalodon is a large-scale GitHub Actions supply-chain campaign that compromised thousands of repositories through malicious workflow injection. The campaign harvested secrets, API keys, and CI/CD credentials by abusing the trusted GitHub Actions infrastructure. Representing a shift toward large-scale CI/CD and workflow-based propagation.
Fig: Shai Hulud Attack Flow
Mini Shai-Hulud shifted focus from repository modification toward credential acquisition at scale.
Rather than relying exclusively on workflow injection, the malware harvested:
Access to these credentials enabled attackers to directly compromise repositories, publish malicious package versions, and expand access across multiple software ecosystems.
Several observed incidents shared operational characteristics with this approach:
The compromised DurableTask package contained malicious code embedded in the init.py file, ensuring execution whenever the package was imported. The malware harvested credentials and facilitated repository compromise and supply-chain propagation.
The LiteLLM compromise demonstrated how a single upstream dependency compromise could affect downstream organizations. Attackers leveraged Python’s .pth initialization mechanism alongside legitimate utilities to achieve execution and exfiltration.
The Xinference compromise targeted cloud credentials, API tokens, SSH keys, and cryptocurrency wallet data through malicious package updates distributed via PyPI.
The Guardrails-AI incident embedded malicious code directly within package initialization routines to facilitate credential theft and environment reconnaissance.
Fig: Mini Shai-Hulud Attack Flow
During recent investigations, multiple GitHub repositories titled “Miasma-Open-Source-Release” were observed online. Several appeared to have been published through compromised developer accounts.
Analysis of the released source code revealed a modular framework designed to automate credential harvesting, repository compromise, package publication, and propagation across multiple developer ecosystems.
Unlike earlier campaigns that primarily focused on a single ecosystem, Miasma attempts to operate across:
Analysis of the source code indicates a provider-based architecture that separates credential collection, validation, exfiltration, and propagation functions into independent modules.
Key capabilities observed include:
Fig: Bun-Based Architecture Reflects Emerging Malware Development Trends
The project contains both Bun and npm configuration files, indicating intended compatibility across multiple JavaScript ecosystems. The malware is written in TypeScript and designed to run on the Bun runtime.
The ARCHITECTURE.md file describes a workflow consisting of:
A worm that aims to automate spreading across multiple developer tooling ecosystems. Written in TypeScript, executed via Bun, designed for CI/CD environments (especially GitHub Actions) and developer machines. Exfiltrates secrets and propagates through NPM packages, PyPI wheels, RubyGems, GitHub repositories and Actions, Claude settings hooks, SSH, and AWS SSM.
Project documentation indicates the framework can operate without dedicated command-and-control infrastructure by leveraging compromised credentials and platform-native services. No dealing with takedowns or maintaining infrasturcture. Stolen GitHub PATs are all that is necessary.
Highly modular and easy to tune using AI.
Fig: Miasma Core Execution Architecture
The architecture separates credential harvesting from propagation logic, allowing the malware to adapt to multiple environments without requiring substantial code changes.
Analysis of the buildProviders() implementation shows support for multiple secret sources, including:
This design allows centralized discovery and collection of credentials across cloud and developer environments.
Fig: Secret Harvesting Provider Initialization Workflow
One of the most significant capabilities observed involves GitHub Actions workflow abuse.
The injected workflows utilize the GitHub Actions secrets context to enumerate available repository secrets and export them into workflow artifacts accessible to the attacker.
This technique reduces reliance on external command-and-control infrastructure and blends into legitimate CI/CD activity.
Fig: GitHub Actions Artifact Exfiltration Technique
The mutator component appears responsible for automated propagation across:
The modular design suggests the malware is intended to compromise multiple software ecosystems simultaneously rather than relying on a single infection vector.
Fig: Miasma Supply Chain Propagation Framework
Monitor for:
Monitor:
Monitor access to:
Monitor:
| Tactic | Technique ID | Technique Name | Observed Activity |
| Initial Access | T1195.001 | Supply Chain Compromise: Software Dependencies and Development Tools | Publishes malicious npm, PyPI, and RubyGems packages to propagate through trusted software ecosystems. |
| Execution | T1059.007 | Command and Scripting Interpreter: JavaScript | Written in TypeScript and executed via Bun to perform harvesting, propagation, and workflow manipulation. |
| Persistence | T1677 | Server Software Component: CI/CD Workflow Injection | Modifies GitHub Actions workflows to establish persistence and execute malicious code within CI/CD pipelines. |
| Credential Access | T1528 | Steal Application Access Token | Harvests GitHub PATs, npm tokens, RubyGems credentials, OIDC tokens, and cloud access tokens. |
| Credential Access | T1552.004 | Private Keys | Harvests SSH private keys for lateral movement and propagation. |
| Discovery | T1580 | Cloud Infrastructure Discovery | Enumerates AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, Kubernetes Secrets, and HashiCorp Vault. |
| Collection | T1213 | Data from Information Repositories | Extracts secrets and credentials from repositories, cloud secret stores, and developer tooling. |
| Exfiltration | T1567.002 | Exfiltration to Cloud Storage | Abuses GitHub Actions artifacts to store and retrieve exfiltrated secrets. |
| Impact | T1199 | Trusted Relationship | Abuses trusted relationships between repositories, package registries, CI/CD pipelines, and cloud identities to propagate. |
| Sha256 | FileName |
| 6331d1511783dcb1158fb54775f563e90399b3a2a81a584d3cba9a77f63d15a7 | Miasma-Open-Source-Release-main.zip |
| 58215f1d737443fd782f91c57ec10ad58109a96470054707fc6bfd6358abe468 | BASH_LOADER.sh |
| 3f3f42d072bd36860ab7bd7fb5e10ac0d22c741c13c89505ccd6ec0ea572eea7 | workflow.yml |
The journey from Shai-Hulud to credential-focused supply-chain campaigns and the rise of Miasma shows how software repositories, package registries, CI/CD pipelines, cloud identities, and developer tools are increasingly becoming key areas that could be targeted. Although we haven’t confirmed direct links between these campaigns, their common focus on credential theft, misuse of trusted development infrastructure, and automated spread highlights a broader shift in supply-chain risks. To stay protected, organizations should consider bolstering repository security, closely watch their CI/CD processes, safeguard cloud identities, and use secret management tools to help reduce the risks from this growing threat.
Contributors:
Pandurang Terkar
Rudra Pratap
