Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attack

Researchers report an active cross-ecosystem supply-chain campaign (linked to the Shai-Hulud / Miasma / Hades families) that trojanized numerous npm packages and a Go module to install a Bun-based loader and an infostealer that harvests developer credentials, GitHub/OIDC tokens, and CI/CD secrets, then exfiltrates and uses those credentials to spread via package registries and GitHub Actions.