- 4th June 2026
The Miasma npm worm is back with a second wave targeting 57 packages and 647,204 monthly downloads. Wave 2 drops lifecycle hooks and executes through binding.gyp, bypassing every scanner watching package.json. No CVE exists. The threat actor pivoted within 72 hours of public disclosure of Wave 1.
Claire Harwood