Endor Labs detected ai-sdk-ollama as part of an active self-replicating npm worm named ‘Miasma’ that uses binding.gyp to execute on install, steal cloud credentials, and spread itself.
Trojanized ai-sdk-ollama Delivers Miasma, a Self-Replicating npm Worm via binding.gyp | Blog | Endor Labs
calendar_today
June 5, 2026
domain
endor-labs