
Research
Shai-Hulud Descends to Hades: Miasma Worm Campaign Spreads with New PyPI Wave
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.
exhibition-runner
Advanced tools
This repository is a functional proof of concept for an isolated (generally self updating) node enviornment and a central dispatcher program (similar to mach in gecko).
The intention here is to show what we can do with a few simple techniques to make hacking on systems which use node baesd automation much much better (arguably better then some of our other solutions since iojs is very portable).
The demo should be a simple one liner after cloning the repo (if it's not then I have some bugs to fix)...
./exhibition first attack!
The self install logic is very simple and largely should explain itself I use a combination of os detetion / package.json hashing / exec to ensure we download the right node versions (it's configured in the same file) and also verify we are using the intended node_modules (this works even across branch changes because of hashing).
This has the following dependencies:
(TLDR; should work out of the box just about anywhere darwin/linux)
The command loader is more complex and docopt and babel to provide a ES7 featureset and a documentation format that can wrap even the most awful of our tools (makefile) into nicer documented logic.
See the examples in particular the config which defines groups and how they map (directly inspired by mach).
Let me get this out of the way mach is awesome... I feel like python2.7 is not the best bet forever though and the loading strategy makes mach slower then even my unoptimized PoC (about 4x faster then runnihg mach help on gecko and it should scale because we load only text not python files and all their deps)
FAQs
Command Exhibition!
We found that exhibition-runner demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Research
Socket found 37 malicious PyPI wheels that abuse Python startup hooks to launch a Bun-powered credential stealer tied to Mini Shai-Hulud/Miasma.

Security News
RubyGems and Bundler 4.0.13 introduced an opt-in cooldown feature that delays newly published gems during dependency resolution.

Security News
pnpm 11.5 now recognizes npm staged publish approvals in release metadata, preventing those releases from being mistaken for lower-trust package publishes.