Miasma Worm npm Self-Propagation via Stolen Credentials - Burst Publish

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

Detects malicious npm package propagation indicative of the Miasma/Mini Shai-Hulud worm. The rule identifies suspicious patterns in AuditLogs, specifically burst npm publishes by known malicious actors or involving known malicious package names, as well as the use of weaponized GitHub Actions workflows or unauthorized snapshot branches.