SECURITYMultiple @redhat-cloud-services npm Packages Compromised with Self-Spreading Worm
On June 1, 2026, StepSecurity discovered that several packages in the @redhat-cloud-services npm scope were shipping a multi-stage credential harvester that executes automatically on every npm install via a preinstall hook. The 4.2 MB malicious index.js uses four obfuscation layers — ROT-21, AES-128-GCM, obfuscator.io, and a custom B5 cipher — to evade detection. The payload reads /proc/<pid>/mem to extract masked GitHub Actions secrets directly from Runner.Worker process memory, sweeps AWS, GCP, Azure, Kubernetes, HashiCorp Vault, npm, and CircleCI tokens, and then uses stolen npm tokens with the bypass_2fa publish parameter to autonomously republish backdoored versions of other packages. C2 traffic is disguised as legitimate GitHub API calls, and persistence is achieved by injecting a SessionStart hook into Claude Code settings and a folderOpen task into VS Code workspace configs. All packages were published via GitHub Actions OIDC from the RedHatInsights/javascript-clients repository, confirming the upstream CI/CD pipeline was compromised.
Article · AI POLICYREAD TIME: 6m
Trump Revives Canceled AI Order with Cybersecurity-Focused Executive Directive
Less than two weeks after canceling a broader AI executive order on May 21, 2026, President Trump signed a narrower directive titled Promoting Advanced Artificial Intelligence Innovation and Security. The order directs federal agencies to accelerate AI-enabled cybersecurity capabilities, establishes a government-industry AI Cybersecurity Clearinghouse housed at the Treasury Department in consultation with NSA and CISA, and creates a voluntary framework for evaluating frontier AI models. Within 60 days, NSA, CISA, Treasury, and NIST must develop a classified benchmarking process for designated covered frontier models; developers may voluntarily provide government access to models up to 30 days before release to trusted partners. The order explicitly prohibits mandatory licensing, preclearance, or permitting requirements for AI developers — preserving the innovation priorities that led Trump to shelve the broader proposal. CISA is additionally directed to extend cybersecurity tool access to rural hospitals, community banks, and local utilities, and the Justice Department is instructed to prioritize enforcement against AI-enabled cybercrime.
READ_FULL_LOGarrow_forwardArticle · SECURITYREAD TIME: 18m
Miasma npm Supply Chain Attack: Self-Spreading Worm via Phantom Gyp Technique
In a rolling campaign lasting under two hours on June 3, 2026, the Miasma worm compromised 57 npm packages across 286+ malicious versions, with @vapi-ai/server-sdk (408,000+ monthly downloads) and ai-sdk-ollama (120,000+ monthly downloads) among the largest victims. The attack uses a novel technique called Phantom Gyp: a 157-byte binding.gyp file triggers node-gyp rebuild, which executes the malicious payload via gyp command substitution — bypassing security tools that only scan package.json for preinstall and postinstall hooks. The four-stage obfuscated payload downloads Bun v1.3.13 at runtime and performs comprehensive credential theft across AWS, GCP, Azure, HashiCorp Vault, GitHub Actions, and AI coding assistants including Claude Code, Cursor, and Gemini. The worm propagates across npm and RubyGems by forging SLSA v1 Sigstore provenance attestations to make reinfected packages appear legitimate. Exfiltration was traced to the GitHub account liuende501, which hosts 236 programmatically created repositories used as dead-drops. Indicators of compromise include oversized root index.js files (4+ MB), Bun binaries in /tmp/b-*, and injected .claude/setup.mjs or .cursor/rules/setup.mdc files.
READ_FULL_LOGarrow_forwardArticle · SECURITYREAD TIME: 7m
Laravel-Lang Supply Chain Attack: Every Git Tag Rewritten to Steal CI Secrets
On May 22, 2026, a threat actor compromised four popular Composer packages maintained by the Laravel-Lang organization by rewriting every existing git tag to point to malicious commits, rather than publishing a new poisoned version. The campaign began at 22:32 UTC against laravel-lang/lang (the flagship Laravel translations package with 502 tags) and concluded by 00:00 UTC, also hitting laravel-lang/http-statuses, laravel-lang/actions, and laravel-lang/attributes. The malicious commits add src/helpers.php to the Composer autoload.files map, which causes the payload to execute automatically the moment any Laravel or Symfony application requires vendor/autoload.php at startup — no special trigger needed. The payload fetches a second stage from C2 domain flipboxstudio.info (a typosquat of flipboxstudio.com), drops a PHP loader into /tmp/.laravel_locale/ and an ELF binary, exfiltrates runner environment variables, then self-deletes within 3 seconds. Projects that pin to version ranges and run composer update are affected; those with composer.lock pinning a pre-2026-05-22 commit SHA using composer install only are safe.
READ_FULL_LOGarrow_forwardArticle · SECURITYREAD TIME: 5m
IronWorm and New Miasma Worm Variant Hit npm in Parallel Supply Chain Attacks
Two distinct npm supply chain attacks emerged simultaneously in early June 2026. JFrog's IronWorm is a Rust-based information stealer distributed through a compromised npm account named asteroiddao, targeting 86 environment variables plus credentials for OpenAI Codex, Anthropic, Cursor, AWS, Docker, and Kubernetes, while hiding via an eBPF kernel rootkit and routing C2 traffic over Tor. Malicious commits spanning nine GitHub organizations were made under the author name claude to impersonate Anthropic's AI chatbot. Separately, the Miasma worm returned with a new Phantom Gyp variant that compromised 57 npm packages across 286+ versions, including ai-sdk-ollama and packages from the jagreehal maintainer family with 120,000+ monthly downloads. OX Security found Miasma also drops a secondary JavaScript payload retrieved via a GitHub dead-drop keyword search for firedalazer, creating a perpetual infection loop. Both attacks exploit GitHub's trusted, widely whitelisted infrastructure for C2 and exfiltration, making network-level detection nearly useless with standard tooling.
READ_FULL_LOGarrow_forwardArticle · SECURITYREAD TIME: 4m
Claude Code GitHub Action Flaw Let a Single Malicious Issue Hijack Repositories
Security researcher RyotaK of GMO Flatt Security disclosed a critical flaw in Anthropic's Claude Code GitHub Action that allowed a single malicious GitHub issue to fully compromise any public repository running the action, including potentially Anthropic's own action repository. The root cause was a faulty trigger check: agent mode trusted any actor whose name ended in [bot], since anyone can register a GitHub App and use its token to open issues on public repos. Exploiting this with indirect prompt injection, RyotaK crafted an issue body that caused Claude to read /proc/self/environ and write environment variable values back into the issue. The stolen OIDC credentials could then be replayed to obtain a Claude GitHub App installation token with write access to the target's code, issues, and workflow files. Anthropic fixed the issue within four days of the January report; the fix is in claude-code-action v1.0.94, rated CVSS v4.0 7.8. A real-world precursor: a prompt-injected issue title against Cline's triage workflow in February led to theft of an npm publish token and the unauthorized publication of cline@2.3.0.
READ_FULL_LOGarrow_forwardArticle · SECURITYREAD TIME: 4m
OpenAI Codex Authentication Tokens Stolen via codexui-android npm Supply Chain Attack
Aikido Security researcher Charlie Eriksen disclosed that the codexui-android npm package — a functional remote web UI for OpenAI Codex with 29,000+ weekly downloads — has been silently exfiltrating Codex authentication tokens for roughly a month. The malicious code reads ~/.codex/auth.json and sends the access_token, refresh_token, id_token, and account ID to sentry.anyclaw[.]store, a server impersonating the legitimate Sentry monitoring platform. The domain was registered on April 12, 2026, just two days after the first package version. Because the refresh_token does not expire, an attacker holding it has persistent, silent access to the victim's Codex account and all associated resources. The same exfiltration chain was also found in two Android apps published by BrutalStrike on the Play Store: OpenClaw Codex Claude AI Agent (50,000+ downloads, package gptos.intelligence.assistant) and Codex (10,000+ downloads, package codex.app). Both apps run the unversioned npm package inside a PRoot Termux sandbox, pulling whatever malicious version is currently live on npm. The package author friuns (Igor Levochkin) denied sharing data with third parties but did not explain why the tokens were collected.
READ_FULL_LOGarrow_forwardsummarizeDigest_Summary
The week of June 1-7, 2026 saw a severe npm supply chain crisis unfold in parallel waves. On June 1, StepSecurity disclosed that multiple @redhat-cloud-services npm packages were shipping a multi-stage credential harvester executed via a preinstall hook. The 4.2 MB malicious index.js used four obfuscation layers (ROT-21, AES-128-GCM, obfuscator.io, and a custom B5 cipher) to read /proc/pid/mem and extract masked GitHub Actions secrets directly from Runner.Worker process memory, sweeping AWS, GCP, Azure, Kubernetes, HashiCorp Vault, npm, and CircleCI tokens. The worm propagated by using stolen npm tokens with the bypass_2fa publish parameter to republish backdoored versions of other packages, and achieved persistence by injecting a SessionStart hook into Claude Code settings and a folderOpen task into VS Code workspace configs. The CI/CD source was confirmed as the compromised RedHatInsights/javascript-clients GitHub Actions pipeline.
Two days later on June 3, the Miasma worm struck using a novel Phantom Gyp technique: a 157-byte binding.gyp file triggered node-gyp rebuild and executed payloads via gyp command substitution, bypassing security tools that only scan package.json hooks. Miasma compromised 57 packages across 286+ versions in under two hours, including @vapi-ai/server-sdk (408,000+ monthly downloads) and ai-sdk-ollama (120,000+ monthly downloads). It downloaded Bun v1.3.13 at runtime, stole credentials across cloud providers and AI tools including Claude Code, Cursor, and Gemini, and forged SLSA v1 Sigstore provenance attestations to appear legitimate. Simultaneously, JFrog identified IronWorm — a Rust-based stealer distributed via the compromised asteroiddao npm account — targeting 86 environment variables with eBPF rootkit concealment and Tor-routed C2, making commits under the author name claude to impersonate Anthropic.
Also disclosed this week: a critical CVSS 7.8 vulnerability in the Claude Code GitHub Action (fixed in v1.0.94) allowed a single malicious GitHub issue to hijack any public repository via indirect prompt injection, reading /proc/self/environ and replaying OIDC credentials. Separately, the codexui-android npm package with 29,000+ weekly downloads had been silently exfiltrating OpenAI Codex authentication tokens for roughly a month to a domain impersonating Sentry. The Laravel-Lang supply chain attack (May 22) rewrote all git tags on four Composer packages to execute a PHP autoload payload on every vendor/autoload.php call. A Trump executive directive established an AI Cybersecurity Clearinghouse at the Treasury Department, required classified frontier model benchmarking within 60 days, and directed CISA to extend cybersecurity tool access to rural hospitals and local utilities.
Key Takeaways- The Phantom Gyp technique used by Miasma bypasses all security tools that only scan package.json preinstall/postinstall hooks — add binding.gyp scanning to your supply-chain security tooling immediately.
- Both Miasma and the @redhat-cloud-services worm forge or abuse legitimate infrastructure (Sigstore SLSA attestations, GitHub OIDC, Claude Code settings injection) to appear trusted — perimeter tools alone cannot stop these attacks.
- The Claude Code GitHub Action CVSS 7.8 vuln (fixed in v1.0.94) showed that prompt injection via a GitHub issue body can read /proc/self/environ and replay OIDC tokens — update to v1.0.94 now if you have not already.
