AIFIRST Miasma npm supply chain attack plants backdoors via Claude Code hooks
The brief
A poisoned-package campaign hit 32 npm packages (117k weekly downloads) plus 57 more.
Key points
- Malware persists through Claude Code SessionStart hooks and VS Code tasks, exfiltrates cloud and git credentials, and survives.
Sources
- r/PromptEngineeringreddit.com