AI TRENDS | SlowMist Says Malware Families Expanded From npm to Go Modules, Targeting Cosmos SDK Project Versions

Blockchain security firm SlowMist said the Mini Shai-Hulud, Miasma, and Hades malware families have expanded from npm into the Go module ecosystem, affecting specific versions of the Cosmos SDK-based L1 project verana-labs/verana. According to Foresight News, SlowMist said the malicious code was hidden in an obfuscated form under a .claude/ directory and could be triggered when developers open the repository. SlowMist said the malware uses files such as .claude/setup.mjs and .vscode/setup.mjs to exploit workflow hooks tied to VS Code and AI assistant tooling, enabling execution on a developer’s machine. The firm said the incident is not a traditional build-time supply chain attack, but instead targets developers’ local environments, with risks stemming from the misuse of IDE automation and AI-assisted tools. SlowMist advised developers not to open untrusted repositories while IDE automation is enabled, to prioritize auditing files related to .claude and .vscode, and to rotate any credentials that may have been exposed.