The article describes real supply-chain campaigns where attackers hid credential-stealing code inside trusted open-source packages and developer tools. When a developer or CI system installed the package, the malware ran immediately, stole cloud and pipeline credentials, and enabled unauthorized cloud activity using valid access. The key message is that removing the bad package is not enough, teams must rotate exposed credentials and investigate what those credentials could access in the cloud.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
You run npm install, it fails, you shrug it off. But that failed install might’ve just logged into your cloud. In the Shai-Hulud campaign, a poisoned @ctrl/tinycolor package ran a preinstall hook that stole cloud and CI secrets, then pushed them to a public GitHub repo created under the victim’s own account. Another campaign used a GitHub account called BufferZoneCorp to ship fake Ruby and Go utilities. During install they grabbed env vars, rewrote GOPROXY, and even added an SSH key to ~/.ssh/authorized_keys on build hosts. If any untrusted package ever ran on your dev box or CI, don’t just uninstall it, immediately rotate those credentials and review your cloud audit logs for weird API calls.
Researchers described AmnesiaStealer, a macOS info-stealer spread through a counterfeit “Download for macOS” page that tricks users into pasting a command into Terminal. The malware steals passwords and browser session data, and can even give an attacker live, hidden control of the victim’s browser…
Security researchers showed that simply opening a GitHub issue could trigger default CI workflows in popular coding-agent projects and lead to code execution or secret exposure. The weaknesses were not in the AI models themselves, but in the surrounding automation (“harness”) that allowed untrusted…
Researchers showed that a single public GitHub issue (from someone with no repo access) could steer popular AI coding agents into running dangerous commands, exposing tokens, and changing repositories. The risk comes from AI agents reading untrusted issue/PR text while also having access to…
Researchers found real GitHub repositories containing poisoned AI-agent instruction/config files (like CLAUDE.md and .cursorrules) that silently tell coding assistants to steal prompts, environment variables, and credentials. The malicious instructions can trigger hidden commands (for example, curl…
ICMacOS is a commercially sold Mac malware kit that uses fake websites to convince victims to paste a command into Terminal. The command installs malware and displays a fake macOS password prompt, putting browser credentials, cloud access, developer secrets, and cryptocurrency wallets at risk. The…
Researchers described how an external user with only chat access to an Amazon Bedrock AgentCore agent could prompt it to fetch a cloud credential endpoint and inadvertently reveal temporary AWS credentials. Those credentials could then be used to enumerate other agents, access container images,…
