# dbmux maintainer-account takeover: four backdoored versions seeded across two release branches

> Between 2026-06-04 and 2026-06-05 the `dbmux` npm maintainer account (`bhagyamudgal`) was hijacked and four backdoored releases were pushed across both the legacy `1.x` and current `2.x` branches: `1.0.5`, `1.0.6`, `2.2.4`, `2.2.5`. GHSA-62wx-5f55-w8g2 (published 2026-06-09) classifies all four as CWE-506 embedded malicious code: any host that installed or executed them should be treated as fully compromised. npm deprecated every malicious release; the clean latest is `2.2.3`.

- Published: 2026-06-09
- Last updated: 2026-06-21
- Severity: critical
- Kind: Compromise - A legitimate, already-used package, maintainer account, CI pipeline, or release tag was hijacked and a malicious version was published under a name people already depend on.
- Ecosystems: npm
- Scope: 1 package, 4 compromised versions
- Tags: maintainer-takeover, account-takeover, credential-theft, infostealer, worm, ci-cd-compromise
- Threat actor: Miasma supply-chain worm
- Also known as: Miasma dbmux wave
- Detected by: SupplyChainAttack.org, GitHub Advisory Database, Snyk
- Incident ID: npm-2026-06-09-dbmux-maintainer-takeover

## Affected packages (1)

Only the exact versions listed were named by the source advisories. Other versions are not implicated.

| Package | Ecosystem | Compromised versions |
|---|---|---|
| [dbmux](https://dependencywatch.io/package/npm/dbmux) | npm | 1.0.5, 1.0.6, 2.2.4, 2.2.5 |

## What happened

`dbmux` is a database-management CLI ("A flexible database management CLI tool with persistent configuration") published since 2025-07-07 by maintainer `bhagyamudgal`. The package had been quiet since 2026-01-13 (last clean release `2.2.3`) when, on 2026-06-04 and 2026-06-05, four out-of-band releases appeared:

- `2.2.4` (2026-06-04) - patch bump on the current `2.x` branch
- `1.0.5` (2026-06-04) - patch bump on the legacy `1.x` branch, ~6 months after `1.0.4`
- `2.2.5` (2026-06-05) - second patch on `2.x`
- `1.0.6` (2026-06-05) - second patch on `1.x`

The parallel-branch pattern is a classic post-takeover move: pushing a backdoored release on both the legacy and current branches maximises catchment across consumers pinning either range. GitHub Advisory `GHSA-62wx-5f55-w8g2` was filed 2026-06-09 and classifies the four releases as CWE-506 Embedded Malicious Code, with the standard "any computer that has this package installed or running should be considered fully compromised" treatment.

## Payload mechanics

Per SupplyChainAttack.org's report (shared with Cyber Security News and gbhackers), the malicious payload uses standard Node primitives - `child_process.spawn`, `process.env` scraping, file I/O on `~/.aws`, `~/.ssh`, `~/.npmrc`, `.env` files in the working tree - and opens a covert command channel back to operator-controlled infrastructure. Because Node applications often run with developer credentials, build tokens, or CI secrets mounted into the runtime environment, the malware has a direct path to sensitive secrets and keys without needing any privilege escalation.

## Detection and timeline

- 2026-06-04 03:55 UTC (approx) - first malicious versions (`1.0.5`, `2.2.4`) published
- 2026-06-05 - second wave (`1.0.6`, `2.2.5`) published
- 2026-06-09 - GitHub Advisory `GHSA-62wx-5f55-w8g2` published; npm deprecates all four versions with reason "unauthorized security release from supply-chain activity"
- 2026-06-09 - SupplyChainAttack.org / Cyber Security News public disclosure
- 2026-06-10 - gbhackers, Cyber Press, Snyk, Hacktron AI republish the advisory

## Attribution - Miasma worm (npm-support assigned, 2026-06-21 update)

When the 2026-06-09 ingest catalogued this incident the attribution line read "actor unknown". Re-checking the npm registry on 2026-06-21, the deprecation tombstones that npm-support now ships on `1.0.5`, `1.0.6`, `2.2.4`, and `2.2.5` explicitly read: *"unauthorized release published by the Miasma supply-chain worm on 2026-06-04…"*. Snyk's advisory `SNYK-JS-DBMUX-17223227` (published 2026-06-07, credit Guy Korolevski) corroborates the framing - the dbmux releases are described as a **self-propagating cloud-secret stealer** consistent with the Miasma signature already documented in the 2026-06-01 `@redhat-cloud-services/*` wave.

Snyk's analysis also surfaces a payload mechanic the original disclosure missed: the dropper is delivered via a malicious **`binding.gyp` + `package/index.js`** shadow entry-point rather than a `postinstall` lifecycle hook - the implant fires silently the moment the package is required, even when `npm install --ignore-scripts` is in effect. Defenders relying on `ignore-scripts` as a mitigation are NOT covered.

## Impact

- Arbitrary command execution on developer workstations and CI runners that ran `npm install dbmux`
- Covert C2 channel back to operator-controlled infrastructure via spawned Node child processes
- Theft of environment variables, local files, build secrets, and CI tokens mounted into the runtime
- Persistent backdoor: simple `npm uninstall dbmux` cannot guarantee removal once arbitrary code ran
- Dual-branch poisoning increases blast radius: teams pinned to `^1.0.4` (legacy) AND `^2.2.3` (current) both pulled malicious updates

## What to do

1. Pin `dbmux` to `2.2.3` (or any version `<= 2.2.3` / `<= 1.0.4`). Block `1.0.5`, `1.0.6`, `2.2.4`, `2.2.5`
2. Treat any workstation or CI runner that executed a malicious version as fully compromised - re-image rather than clean
3. Rotate from an uncompromised machine: AWS/GCP/Azure access keys, GitHub/GitLab/npm tokens, SSH keys, database passwords, and anything in `.env` that the affected host could read
4. Audit `npm` publish history under your team accounts for unexpected releases between 2026-06-04 and 2026-06-05 - the same actor may have reached other accounts in the same window
5. Enable npm 2FA with publish enforcement on every maintainer account; revoke any long-lived classic tokens

## Check your own dependencies

- Check a package-lock.json against this incident: https://dependencywatch.io/check/package-lock-json

The scan runs entirely in the browser; lockfile contents are never uploaded.

## References

- [GHSA-62wx-5f55-w8g2: Malicious code in dbmux](https://github.com/advisories/GHSA-62wx-5f55-w8g2) - GitHub
- [dbmux on npm (1.0.5/1.0.6/2.2.4/2.2.5 deprecated)](https://www.npmjs.com/package/dbmux) - npm
- [dbmux 2.2.5 vulnerability report](https://www.hacktron.ai/package/npm/dbmux/2.2.5) - Hacktron AI
- [dbmux security advisory](https://security.snyk.io/package/npm/dbmux) - Snyk
- [SNYK-JS-DBMUX-17223227: dbmux malicious code (self-propagating cloud-secret stealer)](https://security.snyk.io/vuln/SNYK-JS-DBMUX-17223227) - Snyk

---

Canonical page: https://dependencywatch.io/incident/npm-2026-06-09-dbmux-maintainer-takeover
Markdown version: https://dependencywatch.io/incident/npm-2026-06-09-dbmux-maintainer-takeover.md
Site index for agents: https://dependencywatch.io/llms.txt
DependencyWatch.io is operated by Precursor Security (https://precursorsecurity.com).