Npm on HackingPassion.com : root@HackingPassion.com-[~]

The Miasma Worm Hid in Microsoft's Code and Ran the Moment You Opened It

Thu, 11 Jun 2026 12:08:30 +0200

GitHub disabled 73 of Microsoft’s own repositories in 105 seconds, after a worm called Miasma planted a credential stealer inside Microsoft’s Azure code on GitHub.

The part that makes this different is how it ran. A developer did not need to build the project or install a package. Opening one of those repositories in an AI editor, VS Code, Claude Code, Cursor, or Gemini, was enough to set it off. 😱

Bitwarden CLI Backdoored on npm for 93 Minutes

Fri, 24 Apr 2026 11:30:31 +0200

Bitwarden’s CLI was backdoored and pushed to npm on April 22, 2026. It was live for 93 minutes. Every developer who installed it during that window has to treat their entire machine as compromised. GitHub tokens, SSH keys, AWS credentials, cloud secrets. All of it.

If you followed the Shai-Hulud story back in November 2025, this will sound familiar. That attack spread through npm and hit packages from Zapier, Postman, PostHog, and hundreds of others. 132 million monthly downloads affected. Stolen credentials dumped into public GitHub repositories for anyone to find. This new attack names itself Shai-Hulud: The Third Coming, after the giant sandworms from Frank Herbert’s Dune. The irony is that this third wave specifically targets AI tools.

Axios npm Supply Chain Attack: How a Fake Meeting Compromised 100 Million Downloads

Sat, 04 Apr 2026 13:50:24 +0200

Axios, the JavaScript library with over 100 million weekly downloads, was compromised on March 31st. For roughly three hours, every fresh install of those two versions silently dropped a remote access trojan on the machine that ran it. Windows, macOS, and Linux, all targeted. The installation completed normally, nothing flagged the change, and the backdoor was already running by the time the command finished. 😏

Axios is a JavaScript HTTP client that developers use to send web requests from their applications. It ships inside frontend frameworks, backend services, mobile apps, and CI/CD pipelines, and if a company runs Node.js anywhere in their stack, Axios is almost certainly somewhere in that dependency tree. That is what made this attack so significant.