Miasma campaign targets npm ecosystem, compromising AI packages

// 58d agoSECURITY INCIDENT

Miasma campaign targets npm ecosystem, compromising AI packages

The Miasma supply chain campaign, which previously compromised 32 Red Hat packages, is now targeting the npm ecosystem in a new wave of attacks. This campaign specifically targets high-traffic AI packages, including vapi-ai/server-sdk with 71,000 weekly downloads and ai-sdk-ollama with 31,000 weekly downloads.

// ANALYSIS

Supply chain attacks are increasingly targeting the rapidly growing AI developer ecosystem to maximize their blast radius.

–Miasma's pivot from Red Hat packages to the npm ecosystem demonstrates the campaign's persistence and adaptability.
–The specific targeting of high-download AI tools indicates attackers are strategically following current developer trends to compromise as many systems as possible.
–The focus on AI SDKs highlights the critical need for robust dependency verification in modern AI development workflows.

// TAGS

securitysupply-chainmalwarenpmmiasmaaijavascript

DISCOVERED

58d ago

2026-06-04

PUBLISHED

58d ago

2026-06-04

RELEVANCE

8/ 10

AUTHOR

AikidoSecurity

// KEEP READING

More AI developer news from the feed

EXPLORE FULL FEED

MODEL25m ago

DeepSeek-V4-Flash-High excels at low-cost frontend coding

AI researcher Elvis Saravia (@omarsar0) highlighted the impressive front-end development capabilities of DeepSeek-V4-Flash-High during recent testing. He noted that the model's output quality was high enough to prompt a double-check of which model was actively being used, praising its performance-to-price ratio.

TUTORIAL55m ago

DAIR.AI offers harness engineering, evals training

DAIR.AI emphasizes harness engineering and model evaluations as essential skills for building production-grade AI applications. The platform is releasing educational resources and courses focused on evaluation harnesses and systematic testing.

TUTORIAL1h ago

Dual Blackwell GPUs run 167 GB DeepSeek-V4 FP8

A developer shared a deployment recipe for running the official FP8 version of DeepSeek-V4-Flash-0731 alongside DSpark speculative decoding on a dual NVIDIA RTX PRO 6000 Blackwell (SM120) GPU rig. Requiring approximately 167 GB of VRAM, the model fits cleanly across the system's combined 192 GB VRAM capacity (2× 96 GB) without offloading or truncation.