Miasma’s npm supply chain attack exposes secret governance gaps

At a glance

What this is: This is an analysis of the Miasma npm supply chain campaign and its key finding that build-time malware can still steal secrets, tokens, and cloud credentials at scale.

Why it matters: It matters because NHI, IAM, and cloud teams need to govern package execution paths, secret exposure, and token scope together instead of treating them as separate risks.

By the numbers:

• The attack affected 57 packages and more than 647,204 monthly downloads.
• Over 118 repositories in GitHub contained stolen credentials.
• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security.

👉 Read OXSecurity's analysis of the Miasma npm supply chain attack

Context

Miasma is a supply chain malware campaign targeting npm packages through build-time execution, which means the compromise happens before many teams think of security controls as active. In practice, this turns package installation into an identity and secrets problem as much as a software integrity problem, because attackers are after tokens, cloud credentials, and repository access.

The article shows why NHI governance has to extend into software delivery pipelines. When package scripts or build hooks can run with access to GitHub tokens, npm tokens, and cloud credentials, the boundary between code trust and identity trust collapses. That is a familiar failure pattern in modern development environments, not an isolated anomaly.

Key questions

Q: What breaks when package installation can execute hidden build logic?

A: Package installation stops being a passive import step and becomes an execution event. Hidden build logic can harvest tokens, inspect local secrets, and stage persistence before most runtime controls see anything. That is why build-time execution must be governed like any other privileged entry point, especially in CI and developer workstations.

Q: Why do exposed GitHub and cloud tokens make supply chain malware so damaging?

A: Because those tokens are already trusted identities, not just files. If they are valid, scoped too broadly, or not rotated quickly, attackers can reuse them to access repositories, pipelines, and cloud resources. The malware does not need to invent privilege when it can steal it and reuse it immediately.

Q: How should security teams reduce risk in software delivery pipelines with NHI controls?

A: Start by inventorying every automation identity in the delivery chain, then convert long-lived credentials into short-lived, task-scoped access. Pair that with least privilege, separate approval for signing and promotion steps, and regular revocation of stale tokens. The goal is to prevent one compromised pipeline identity from reaching production or modifying trusted artifacts.

Q: Who is accountable when a package repository compromise exposes enterprise credentials?

A: Accountability sits with the teams that own publishing access, dependency governance, secrets management, and endpoint containment. Frameworks such as OWASP NHI and NIST CSF matter because the failure is not only malware execution, but the absence of lifecycle control over the identities and secrets that the pipeline depended on.

Technical breakdown

How build-time execution turns package installs into an attack path

npm packages can execute code during installation through lifecycle hooks or equivalent build-time mechanisms. In this campaign, the malware bypassed ordinary postinstall scrutiny by using a weaponized binding.gyp file, which behaves like a preinstall step. That matters because defenders often focus on published package contents, while the real risk sits in what executes when the dependency is fetched and built. Once that code runs, it can inspect the local environment, collect tokens, and stage follow-on actions before any runtime application control has a chance to intervene.

Practical implication: review and restrict build-time execution paths, not just package contents.

Why stolen secrets become non-human identity abuse

The malware harvested GitHub tokens, npm tokens, and cloud credentials, which are all non-human identities or secrets that can authorize systems without human presence. These credentials often outlive the install session and may have broader scope than the build actually needs. That makes the resulting compromise an NHI governance failure, not merely a malware event. If those secrets are stored in local environments, CI systems, or developer workstations, attackers can reuse them to pivot into repositories, pipelines, and cloud resources long after the initial infection.

Practical implication: classify build tokens and cloud keys as governed NHIs with strict scope and expiry.

How supply chain malware scales through trusted repositories

Supply chain malware works by converting trust in the package ecosystem into downstream propagation. Once a malicious release lands in a commonly used dependency, every installation becomes a potential execution event, and the blast radius is measured in repositories, workstations, and cloud sessions rather than one endpoint. The Miasma variant also shows attacker adaptation: when defenders start blocking one execution path, the malware shifts to another. That is why package integrity, secret hygiene, and identity controls must be treated as one control plane.

Practical implication: pair dependency governance with secret detection and token revocation workflows.

Threat narrative

Attacker objective: The attacker objective was to harvest reusable credentials and extend access across repositories, pipelines, and cloud environments.

1. Entry occurred when compromised npm packages were installed and the malicious build logic executed through a weaponized binding.gyp file.
2. Credential harvesting followed as the malware stole GitHub tokens, npm tokens, and cloud credentials from the environment.
3. Impact appeared as over 118 repositories containing stolen credentials and a wider supply chain blast radius across affected packages.

Breaches seen in the wild

• Shai Hulud npm malware campaign — Shai Hulud campaign: npm malware exposed secrets on GitHub.
• GitHub Dependabot Breach — GitHub Dependabot tokens stolen and abused to push malicious commits to repositories.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Build-time execution is now a governance boundary, not a developer convenience. Supply chain malware like Miasma shows that install-time logic can become the real attack surface even when package content review looks clean. The control gap is not just malicious code detection, but the assumption that dependency installation is a low-risk administrative step. Practitioners should treat build hooks, preinstall equivalents, and CI execution as governed entry points.

Non-human identity exposure is the force multiplier in modern package compromise. When malware steals GitHub tokens, npm tokens, and cloud credentials, the blast radius comes from the authority those secrets already carry. This is why NHI governance and software supply chain security overlap directly in build pipelines. If tokens are broadly scoped or long-lived, a single infection becomes multi-system access.

Secret sprawl creates a hidden trust chain that attackers can reuse faster than teams can remediate. The article’s finding that stolen credentials were found in many infected repositories reflects a familiar failure mode: secrets move faster through developer ecosystems than governance can track them. That is the same structural problem highlighted in the Ultimate Guide to NHIs, where visibility and offboarding remain weak. The practical conclusion is that secret placement and token lifetime must be controlled as tightly as application access.

Package compromise is increasingly an identity problem disguised as a code problem. The industry still tends to respond to these events with package allowlists and repository scanning alone, but the attacker value lies in authenticated reuse, not just code execution. This is where 52 NHI Breaches Analysis is relevant: credential abuse repeatedly turns initial compromise into lateral access. Practitioners should read this as a sign to unify supply chain controls with identity governance.

Named concept: build-time identity collapse. This pattern describes the moment when package installation, build execution, and credential trust become indistinguishable to the attacker. Once that collapse happens, a dependency can act like an authenticated agent inside the delivery pipeline. The implication for security teams is clear: if build-time access is not explicitly bounded, the pipeline itself becomes an unwatched NHI.

From our research:

• 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
• Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, according to Ultimate Guide to NHIs.
• Forward pivot: Explore 52 NHI Breaches Analysis for the breach patterns that repeat when secrets and tokens are not governed as identities.

What this signals

Build-time identity collapse will keep appearing wherever package ecosystems, CI pipelines, and secret stores are loosely joined. The practical response is to treat every credential used in build and release paths as a governed identity with its own lifecycle, not as an implementation detail hidden inside DevOps tooling.

The most exposed programmes will be the ones that still rely on broad-scoped developer tokens and inherited pipeline permissions. That is where an identity governance review should start: token scope, storage location, rotation cadence, and revocation speed. The 52 NHI Breaches Analysis helps frame how quickly credential abuse turns into measurable blast radius.

For practitioners

• Restrict build-time execution paths Disable or tightly control package lifecycle hooks, preinstall equivalents, and other implicit execution points in CI and developer environments. Treat binding.gyp and similar build artifacts as execution surfaces that require approval.
• Inventory and scope all pipeline credentials Map GitHub tokens, npm tokens, and cloud keys used by developers and CI systems, then reduce scope to the minimum required and assign explicit expiry. Review whether each secret can be rotated without breaking the pipeline.
• Automate secret detection in repositories and build logs Search for exposed credentials in source, commit history, CI variables, and artifact logs, then tie findings to immediate revocation and rotation. A secret that remains valid after discovery is still an active identity.
• Separate package trust from access trust Do not let dependency approval imply permission to access repository tokens or cloud credentials. Use isolated build identities and short-lived credentials so a compromised package cannot inherit broad runtime authority.

Key takeaways

• Miasma shows that supply chain malware now targets build-time trust as well as package integrity.
• The impact scales because stolen GitHub, npm, and cloud credentials are reusable non-human identities, not just leaked secrets.
• Teams need to govern package execution, secret placement, and token lifecycle as a single control problem.

Key terms

• Install-Time Execution: Install-time execution is code that runs while dependencies are being installed rather than when an application is launched. In supply chain attacks, this matters because the install phase often has access to the richest secrets in developer and CI environments, making it a high-value privilege boundary.
• Non-Human Identity (NHI): A digital identity assigned to a non-human entity such as a software application, service account, API key, bot, machine, or AI agent that enables it to authenticate and interact with systems without direct human involvement. NHIs now outnumber human identities in most enterprises by 25 to 50 times.
• Secrets Sprawl: The uncontrolled proliferation of sensitive credentials — API keys, tokens, passwords, certificates — across codebases, cloud environments, CI/CD pipelines, and configuration files. In 2024, over 50 million leaked secrets were found on the dark web.
• Supply Chain Malware: Malware delivered through trusted software distribution paths such as packages, dependencies, or build tooling. It succeeds by inheriting trust from legitimate workflows, which makes publication-time checks insufficient if the malicious behaviour appears only after install or in a later version.

What's in the full analysis

OXSecurity's full post covers the operational detail this post intentionally leaves for the source:

• The affected package list, version ranges, and download counts that help teams assess exposure scope.
• The infection timeline and repository indicators that can support detection and hunting in GitHub environments.
• The technical sequence showing how binding.gyp substituted for postinstall behaviour in this variant.
• The prior Miasma variants and code reuse details that help teams compare campaign evolution.

👉 The full OXSecurity post covers affected packages, infection mechanics, and the repository evidence trail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners connect identity lifecycle controls to broader security programmes.