Miasma Worm npm Self-Propagation via Burst Package Publish with Stolen Token

Ibrahim Saud@tektrix

•updated Jun 26, 2026•0•0•2

Detects anomalous, high-volume npm package publication patterns from a single user account within a 5-minute window. This behavior is indicative of automated worm propagation or supply chain attacks using compromised developer tokens, specifically identified by high-frequency 'publish' events.