Latest Miasma Attack Uses Blockchain Garbage You Should Have Already Blocked

Threat Intel
,
1

Last Updated: 2026-07-14T22:16:54Z

image
image1440×1080 218 KB

What’s Happening

I was trying to come up with a framing for this story other than “Oh look another supply chain attack, whoopty-doo.”

But yeah, asyncapi packages were hit today.

Actions

Of course you want to do the usual package checks, rotations, say three Hail Marys, turn around three times and throw salt over your shoulder. But also, this payload presents some good reminders about goofy attacker techniques that should not survive a mature network.

Instead of a preinstall or postinstall hook, this attack uses a straight-up malicious script in the package. Then it uses IPFS for a second stage source, and a combination of IPFS, Etherhiding, and…Nostr?? for command and control.

None of that should work on your network. Extremely few people have legitimate business uses for these technologies. Don’t let them function in your walls.

So at the very least, block:

  • ipfs[.]io
  • relay.damus[.]io
  • *.damus.io, really
  • relay.nostr[.]com
  • *.nostr[.]com while you’re at it

Notes

Funny how DHTs continue to support the worst parts of the internet.

Does that include ATProto??

3 Likes
2

Funny how DHTs continue to support the worst parts of the internet.

Yeah, agreed. A lot of censorship resistant technologies definitely have their places in society but your network should not be one of them if you can avoid it. The risk far outweighs any potential benefit in a production environment.

With all the recent supply chain attacks, I wonder how the average detection time of supply chain attacks specifically has been/will be impacted this year.

Loving the Star Trek titles hahah