Miasma campaign targets npm ecosystem, compromising AI packages

// 58d agoSECURITY INCIDENT

Miasma campaign targets npm ecosystem, compromising AI packages

The Miasma supply chain campaign, which previously compromised 32 Red Hat packages, is now targeting the npm ecosystem in a new wave of attacks. This campaign specifically targets high-traffic AI packages, including vapi-ai/server-sdk with 71,000 weekly downloads and ai-sdk-ollama with 31,000 weekly downloads.

// ANALYSIS

Supply chain attacks are increasingly targeting the rapidly growing AI developer ecosystem to maximize their blast radius.

–Miasma's pivot from Red Hat packages to the npm ecosystem demonstrates the campaign's persistence and adaptability.
–The specific targeting of high-download AI tools indicates attackers are strategically following current developer trends to compromise as many systems as possible.
–The focus on AI SDKs highlights the critical need for robust dependency verification in modern AI development workflows.

// TAGS

securitysupply-chainmalwarenpmmiasmaaijavascript

DISCOVERED

58d ago

2026-06-04

PUBLISHED

58d ago

2026-06-04

RELEVANCE

8/ 10

AUTHOR

AikidoSecurity

// KEEP READING

More AI developer news from the feed

EXPLORE FULL FEED

TUTORIAL23m ago

Dual Blackwell GPUs run 167 GB DeepSeek-V4 FP8

A developer shared a deployment recipe for running the official FP8 version of DeepSeek-V4-Flash-0731 alongside DSpark speculative decoding on a dual NVIDIA RTX PRO 6000 Blackwell (SM120) GPU rig. Requiring approximately 167 GB of VRAM, the model fits cleanly across the system's combined 192 GB VRAM capacity (2× 96 GB) without offloading or truncation.

UPDATE1h ago

Genspark Workspace 6.0 drops six major updates

Genspark Workspace 6.0 expands Genspark's ecosystem across six core updates designed to bridge ambient work context into executable workflows. Key releases include SecondBrain Note hardware voice recorder, GenTeam multi-agent collaboration, GenMail email workflows, Genspark Design, AI Slides, and AgentBase for custom databases.

NEWS1h ago

Google begins active development on Gemini 4

Google is reportedly actively developing Gemini 4, its next-generation foundation model designed to be its most advanced AI system to date. Key objectives for the new model include superior reasoning skills, improved coding assistance, and enhanced agentic capabilities for autonomous task execution, while Gemini 3.5 Pro continues testing behind the scenes.