A self-propagating supply-chain worm toolkit just leaked, and it targets the registries your agents pull from.

On June 10, the modular "Miasma" attack framework leaked via compromised developer accounts in a public GitHub repo, per Rescana. It hits PyPI, npm, and RubyGems plus CI/CD systems including GitHub Actions and JFrog Artifactory, using stolen credentials to inject backdoors. The June 11 bulletin confirmed 304-plus components and 73 Microsoft GitHub repos impacted. This weaponizes the exact registries agent toolchains install from unattended. Any pipeline that runs pip install or npm install without pinning and verification is in scope.