Several major software supply chain attacks have hit the open-source ecosystem in June 2026, including one that compromised official Red Hat npm packages with malware nicknamed Miasma, and another — IronWorm — that infected 36 packages used to steal cloud and developer credentials. These aren’t obscure, niche libraries. They sit inside the dependency chains of countless business applications, including bespoke tools built for SMEs.
You don’t need to be a software company for this to matter. If any part of your business runs a custom-built app, an internal dashboard, an e-commerce site, or even a website contact form built on modern JavaScript tooling, there’s a reasonable chance some of that code was assembled from hundreds of small open-source packages — most of which nobody at your business, or even your developer, has individually inspected.
How these attacks actually reach you
Modern software is built by combining thousands of small, reusable code packages rather than writing everything from scratch — it’s faster, cheaper, and normally perfectly safe. The problem is that each of those packages is a potential entry point. In the Miasma case, attackers compromised a single developer’s account at a trusted organisation and pushed malicious code directly into packages that tens of thousands of projects already trusted and used automatically.
Once embedded, this kind of malware typically scans for and steals credentials — cloud platform logins, API keys, payment processor tokens, and source code repository access — then quietly exfiltrates them. The business using the affected software often has no idea anything happened until the stolen credentials are used elsewhere, sometimes weeks later.
What makes these incidents particularly hard to catch is the speed of distribution. Package registries like npm update automatically as part of routine software builds, so a compromised package can spread to thousands of downstream projects within hours of being published — long before security researchers identify and pull it. By the time a compromise is publicly reported, the malicious version may already have been installed, run, and removed again, leaving little trace beyond whatever credentials it managed to steal in that window.
Why SMEs are exposed even without an in-house dev team
If you’ve commissioned a custom app, customer portal, or automation tool from a developer or agency, that codebase almost certainly depends on the same open-source ecosystem currently under attack. You’re trusting not just your developer, but every package your developer’s tools pulled in — and every package those packages depend on, several layers deep.
This is precisely why working with a development partner who actively manages this risk matters. Teams like BuildApps and CoolCoding build in dependency scanning and credential hygiene as standard practice, rather than treating it as an afterthought once something has already gone wrong.
What to ask your developer or IT provider this week
Ask whether your software’s dependencies are scanned for known compromises. Tools that check package versions against threat intelligence feeds exist and are not expensive to run — the question is whether anyone is actually running them on your behalf.
Ask where your API keys and cloud credentials are stored. Credentials embedded directly in code or left in unrotated environment variables are exactly what this malware hunts for. They should be stored in a secrets manager and rotated periodically.
Ask when dependencies were last updated. Software left untouched for a year or more is more likely to be sitting on a vulnerable or already-compromised version of a package without anyone noticing.
The takeaway
You don’t need to understand npm or JavaScript tooling to ask the right question: “How do we know the code our business depends on hasn’t been compromised?” If your developer or agency can’t answer that clearly, this month’s attacks are a good reason to ask before it becomes a more expensive conversation later.
