npm Packages Hacked to Deploy Botnet | Tech News

A chilling npm package breach exposed four @asyncapi tools—like generator-helpers—infected with Miasma botnet malware, hidden in plain sight within source code to evade detection. The attack, launched July 14 in two waves, disguised itself as legitimate GitHub Actions builds, with fake author metadata hinting at pre-release tampering. Once installed, the malware executes a three-stage infection: spawning a stealthy downloader, planting files in system directories, then decrypting and activating the full Miasma tasking framework—designed to operate invisibly across Node.js, Python, and Ruby ecosystems. Listen in comfort:Get a discount on a Soli Pillow: http://solipillow.com/discount/dnn. Advertise on DNN:[email protected] This is an automated, high-level news summary based on public reporting.Report issues to [email protected]. View sources & latest updates:https://sources.thednn.ai/5f9f04df5d82a093