npm/PyPI Supply Chain: When Sigstore Provenance Signs the Malware

Four attacks in seven weeks compromised npm and PyPI. Sigstore and SLSA provenance proved useless: the attacker stole the CI identity, not the signature.

Between early June and July 14, 2026, four distinct supply-chain attacks hit the npm and PyPI ecosystems. Attackers demonstrated they can bypass the latest defenses: from installation scripts disabled by default to provenance verification via Sigstore and SLSA. The decisive technique was not signature forgery, but the compromise of the build identity in the CI/CD pipeline. "Different entry points, one objective: land where the credentials live and leave with them." That is how GitGuardian summarizes the common strategy across the four attacks.

Key Takeaways

Four distinct attacks between June and July 2026: Hades on PyPI, payment SDK typosquatting, stolen npm token for jscrambler, and AsyncAPI CI/CD compromise via pull_request_target exploit
Attackers shifted execution from lifecycle scripts — disabled in npm v12 on July 8, 2026 — to module import, rendering installation-based protections ineffective
Compromised AsyncAPI packages carried valid Sigstore and SLSA attestations: the attacker forged nothing, they stole the build system's OIDC identity
The AsyncAPI pull_request_target vulnerability had been reported 58 days earlier with a proposed fix that was not merged, according to GitGuardian and Wiz

Hades, Miasma, and the Memory of CI Agents

The first wave, identified as a PyPI variant of Miasma bearing the string "Hades - The End for the Damned," struck at least 29 packages in two phases: an initial wave in early June and a second release on June 8. The technically relevant mechanism is the use of *-setup.pth files, executed automatically at Python startup, which download the Bun JavaScript runtime and launch the payload.

StepSecurity documented a specific innovation: Hades includes an adversarial prompt-injection routine designed to deceive automated LLM analyzers. The text inserted at the top of the file is crafted to hijack the analyzer's system instructions and classify the package as verified clean infrastructure. The attack does not stop at execution: a cross-platform memory scraper extracts data from GitHub Actions runners, leveraging /proc/mem on Linux, Mach VM APIs on macOS, and ReadProcessMemory on Windows.

SecurityWeek reported that the combined total of Miasma and Hades exceeds 100 packages and 471 malicious artifacts across npm and PyPI.

The Typosquat That Waits Six Minutes

On July 7, 2026, a coordinated attack on npm and PyPI placed roughly 17 packages with typosquatted names of payment SDKs: paysafe-checkout, paysafe-node, neteller, and related variants. The delayed credential-harvesting technique — designed to evade dynamic analysis sandboxes — proved vulnerable to detection speed: the packages were identified and removed in approximately six minutes. Declared targets in the filtering configuration included AWS_SECRET_ACCESS_KEY, GITHUB_TOKEN, and NPM_TOKEN.

jscrambler: The Stolen Token That Bypassed npm v12

On July 11, 2026, a compromised npm token allowed the publication of five malicious versions of the jscrambler package and related plugins for webpack, gulp, grunt, and metro. The multi-platform native payload was designed to execute on module import or CLI invocation, not during installation. This choice renders ineffective the protection introduced by npm v12, which disabled install scripts by default on July 8, 2026. GitGuardian quantified 1,479 downloads of the malicious versions before removal. The attack was classified as an evolved variant of IronWorm.

AsyncAPI: When CI Signs Malware with Valid Provenance

The July 14, 2026 attack against AsyncAPI encapsulates the technical paradox of the campaign. The attacker opened 37 pull requests as camouflage; one exploited the vulnerable pull_request_target workflow configuration to steal the personal access token of the asyncapi-bot account. With that token, they pushed malicious commits to the next and master branches, publishing four packages in five versions with over 2.25 million combined weekly downloads.

The exposure window lasted approximately four hours: from 07:10 UTC to 11:18 UTC, according to GitGuardian. StepSecurity confirms the push at 06:58 UTC and publication at 07:10 UTC. Payloads execute on require(), download a multi-stage RAT from IPFS, establish persistence via systemd, and communicate with C2 infrastructure over HTTP, Nostr, Ethereum smart contract, and peer-to-peer mesh network.

"The most concerning piece of this for security teams... was that those backdoored packages carried valid Sigstore and SLSA provenance. The attacker did not forge anything. They compromised the CI identity, so the build system signed the malware honestly." — GitGuardian, reporting analysis by Chainguard

Wiz examined the Ethereum smart contract 0x12c37A86a0Ed0beBe5d1d6a43E42f07860eAc710 used as a fallback C2, confirming the address. Palo Alto Networks Unit 42 tracked the campaign as "miasma-train-p1" on July 14, 2026, with a payload descending from the Miasma RAT. The decentralized C2 — leveraging Ethereum, Nostr, and BitTorrent DHT — represents a structural evolution from traditional centralized servers.

Sigstore and SLSA provenance functioned exactly as designed in this scenario: they attested that the package originated from the AsyncAPI CI pipeline. The problem is that the pipeline was compromised. "Provenance proved where the package came from. It said nothing about whether the source was trustworthy when it was built." The distinction between origin authenticity and process integrity has become the blind spot.

What to Do Now

For teams managing open-source dependencies, the campaign imposes four operational priorities:

Verify pull_request_target workflow configuration in public and private repositories: the AsyncAPI vulnerability had been reported 58 days earlier with a proposed fix that was not merged, according to GitGuardian and Wiz
Inspect lock files: malicious AsyncAPI versions can still be resolved by existing installations even after removal from registries
Assess whether static and dynamic analysis tools are vulnerable to adversarial prompt injection like the one documented in Hades
Reevaluate trust placed in provenance attestations: Sigstore and SLSA attest to origin, not the security of the source code at build time

The Boundary Shifted: From Who Installs to Who Imports

The attacks have shifted the risk perimeter. The disabling of install scripts in npm v12 — the correct response to the preinstall problem — was bypassed simply by changing the moment of execution. Module import has become the new trigger. Simultaneously, the CI/CD trust architecture — OIDC, provenance, automated signatures — has been weaponized against those who implement it.

The frequency of attacks — four in seven weeks, with techniques evolving between incidents — normalizes a risk the open-source ecosystem is not structured to absorb. Endor Labs, cited by Cybernews, had anticipated the problem: "The practical implication for defenders: a package can now carry a valid provenance badge and still be malicious." The AsyncAPI and Hades campaign is not a violation of Sigstore's promise: it is the literal fulfillment of that promise applied to a compromised CI.

Sources

Information verified against cited sources and current as of publication.

Sources

Sources and references