Miasma-family worm placed agent instruction files and startup triggers in repositories

SafeDep found that a Miasma-related npm worm extended from package scripts into GitHub repositories by adding forged agent instructions and hooks. The malicious files directed coding assistants to execute an obfuscated setup script as if it were authorized project preparation.

The November update documents twelve third-party repositories with suspicious commits, including CLAUDE.md, AGENTS.md, Cursor and session-start hook surfaces. A repository checkout or tool launch must actually read or execute the planted instructions before the agent-specific payload has an effect. The payload combines ordinary package lifecycle execution with a higher-trust framing for agent instructions. These are different triggers: the package installer can run code without an LLM, while an assistant reading forged repository guidance can promote the attacker's procedure into action.

SafeDep did not establish downstream execution of every poisoned repository or compromised third-party npm packages from the observed November extension. Shared code does not prove that other CI worms have the same operator. Review agent instruction files and session hooks as executable supply-chain inputs, pin trusted versions and disable unreviewed repository-provided startup execution.

Evidence reconciliation and effect boundary. The payload could reach execution by at least two distinct routes: an assistant following a forged project instruction, or a deterministic session hook running the setup script. The second route requires no model obedience, even though its file name sits inside an AI-agent folder. The observed spread must not be merged with wfx-loot on the basis of generic GitHub workflow activity, and a suspicious commit or published artifact is not itself an observed stolen secret.