Advanced botnet malware reached developers across the globe through three coordinated supply chain attacks between June and July 2026, each exploiting compromised open-source packages and code repositories. The Miasma worm initiated the campaign by infiltrating npm packages and Microsoft's GitHub infrastructure; a second group deployed similar tactics through AsyncAPI npm packages; and a separate botnet called GlassWorm, active since early 2025, was finally dismantled in May 2026 after force-pushing malicious code into hundreds of Python repositories. These were not isolated incidents but part of a pattern: attackers systematically targeted developer credentials and CI/CD pipelines to inject malware into widely used open-source projects. Once installed, the botnet framework harvested authentication tokens, SSH keys, and cloud credentials from infected developer machines, enabling attackers to access downstream systems.
Table of Contents
- Timeline of the major attacks
- How the malware works
- Scope and affected systems
- Why these attacks succeeded
- How to protect your development environment
- Frequently Asked Questions
Timeline of the major attacks
The Miasma worm began on June 1, 2026, when it compromised 32 npm packages under the @redhat-cloud-services namespace. Four days later, on June 5, 2026, the worm penetrated Microsoft's GitHub infrastructure by injecting a malicious commit into the Azure/durabletask repository using stolen contributor credentials, affecting core Azure cloud services and deployment tools. Microsoft's automated detection systems disabled 73 repositories across four GitHub organizations within 105 seconds.
In May 2026, the GlassWorm botnet was dismantled through a coordinated operation between CrowdStrike, Google, and the Shadowserver Foundation. Before its takedown, GlassWorm attackers had force-pushed malicious code into over 300 GitHub Python repositories targeting Django applications, machine-learning research code, and Streamlit dashboards, with the earliest injections dated March 8, 2026. On July 14, 2026, four npm packages in the @asyncapi namespace—totaling over 3 million weekly downloads—were compromised to deliver multi-stage malware that deploys the Miasma botnet framework across Windows, macOS, and Linux systems.
How the malware works
The Miasma botnet plants configuration files that trigger credential-harvesting payloads when developers open infected repositories in VS Code, Claude Code, Cursor, or Gemini CLI. This targeting of popular development tools ensures broad impact across developer environments.
Once activated, the malware establishes resilience through multi-channel command-and-control infrastructure including HTTP servers, IPFS gateways, Nostr relays, and BitTorrent DHT, making it difficult to shut down any single point of control. Infected systems automatically exfiltrate developer credentials, API tokens, SSH keys, and wallet data to attacker servers. This credential theft acts as a multiplier: each compromised developer becomes a potential vector for lateral movement into corporate networks, cloud platforms, and downstream open-source projects.
Scope and affected systems
The attacks reached hundreds of repositories and millions of downloads. The AsyncAPI campaign alone affected packages downloaded over 3 million times weekly, meaning the malware potentially reached thousands of developer machines. GlassWorm compromised more than 300 Python repositories on GitHub.
Combined, these campaigns demonstrate how a single successful supply chain compromise can cascade across an entire ecosystem. The targeting was deliberate: attackers focused on widely used packages and infrastructure projects that serve as dependencies for other software. A compromised Azure repository or popular npm package reaches far beyond the immediate adopters to their downstream users.
Why these attacks succeeded
All three campaigns shared a common requirement: credential compromise. Attackers used stolen contributor tokens, leaked account access, or misconfigured CI/CD pipelines to gain initial repository access.
The AsyncAPI attack exploited a CI/CD pipeline vulnerability where pull_request_target checked out untrusted pull request code while retaining base repository secrets access, allowing attackers to compromise the release bot's credentials and push malicious code directly to npm. Strong access controls, credential rotation, and least-privilege token scoping would have either blocked these attacks or severely limited their damage.
How to protect your development environment
Implement Software Composition Analysis (SCA) tools to scan incoming dependencies for known compromises. Verify package signatures when available and restrict CI/CD token permissions to the minimum scope required for each task.
Monitor unexpected network connections from build environments, especially connections to unusual IP addresses or ports. For teams and organizations: enforce credential rotation on a regular schedule, use hardware security keys for critical repository access, and configure your CI/CD platform to disable access for packages with known security incidents. Individual developers should keep their local development environment credentials separate from production secrets and regularly audit which cloud services have access tokens stored locally.
Frequently Asked Questions
How do I know if my development environment was infected?
Monitor for unusual network traffic from VS Code, Claude Code, or your terminal during package installation or repository operations. Check your SSH keys, API tokens, and cloud credentials for recent unauthorized access. If you installed AsyncAPI packages between July 1–14, 2026, or used Azure repositories during June 2026, treat your local credentials as potentially compromised and rotate them immediately.
Is this still active?
GlassWorm was dismantled on May 26, 2026. The AsyncAPI packages were removed from npm within hours of discovery. However, systems that installed these packages during the attack windows may still harbor the malware; credential harvesting may continue until those systems are cleaned and credentials are rotated.
Do I need to change my GitHub token if I use open-source packages?
Yes, if you installed any package from the affected namespaces (@redhat-cloud-services, @asyncapi, or repositories targeted by GlassWorm) or used Azure development tools during June 2026, treat your tokens and SSH keys as compromised and rotate them. Even if your system appears unaffected, credentials stored locally at the time of installation may have been harvested.