New Blog: Miasma Worm Infects Multiple LeoPlatform npm Packages

•

25 Jun 2026

Back to Blog

🚀 Introducing GitLab CI/CD Component

SafeDep Team

• Mar 31, 2025 • 1 min read

Announcing the new GitLab CI/CD Component, available in GitLab CI Catalog for seamless integration of vet in GitLab CI. Protect against vulnerable and malicious packages in your GitLab projects. This integration enables GitLab users to easily integrate vet with their GitLab CI pipelines. This integration protects GitLab projects from vulnerable and malicious packages in the dependency tree.

TL;DR

Usage

Features

Scan all dependencies and report vulnerabilities to GitLab security dashboard

GitLab Security Dashboard Vulnerability List

Integrates with SafeDep Cloud to protect against malicious open source packages through active code analysis

GitLab Security Dashboard

Support

Report bugs and feature requests to GitHub issues
Start feature discussions at GitHub discussions

gitlab
cicd
integration
malware

Author

SafeDep Team

safedep.io

The Latest from SafeDep blogs

Follow for the latest updates and insights on open source security & engineering

Malware

Miasma Worm Infects Multiple LeoPlatform npm Packages

A Miasma worm variant compromised a single maintainer account and used it to publish infected versions of 20 LeoPlatform npm packages within a 3-second window. The worm also pushed weaponized GitHub...

Malware

MYRA: A Full Linux RAT Distributed via npm

The npm package apintergrationpost is a red team RAT called MYRA with native C rootkit, triple persistence, fileless execution, live screen streaming, and process masquerade. This analysis documents...

Malware

The wshu.net npm Campaign Delivers a Multi-Stage Infostealer

One actor seeded 15 npm packages across 13 throwaway scopes in a single morning, each shipping a ~270KB obfuscated downloader behind a postinstall hook. The downloader pulls a Rust infostealer from...

Malware

@withgoogle/stitch-sdk: Scope Squat Harvests Developer Credentials

A malicious npm package squats the @withgoogle scope to impersonate Google Stitch, silently harvesting credentials from Claude Code, git, GitHub CLI, SSH keys, npm, and Docker on install.