TLDR Tech / InfoSec
Inside the Miasma Software Supply Chain Attack Toolkit
Miasma exploits GitHub as C2 via three commit search channels ("DontRevokeOrItGoesBoom", "TheBeautifulSandsOfTime", and "firedalazer"), each delivering encrypted credentials, JavaScript payloads, or remote Python commands without touching traditional infrastructure. The kill chain harvests secrets from AWS/Azure/GCP/Kubernetes and password managers, then propagates via npm/PyPI/RubyGems OIDC or stolen tokens, SSH lateral movement, GitHub Actions orphan-commit hijacking, and injection into 13 AI coding tools via config poisoning. Detect by hunting GitHub commits for those three search terms, enforce OIDC token scope restrictions in Actions, revoke compromised PATs immediately (triggers the dead-man switch), and monitor for binding.gyp injections and .claude/.cursor/.vscode/.gemini/ config payloads.
Read the full story