Loading...
Loading...
Over the last 48 hours, our security team has tracked an influx of community chatter regarding automated alerts flagging common development dependencies specifically prisma as variants of the Shai-Hulud / Miasma credential stealing worm.
As a digital infrastructure provider, NodeByte is issuing this advisory to help our users separate active supply chain threats from recent upstream tooling false positives.
The Shai-Hulud worm family (and its latest heavily obfuscated variant, Miasma) is an active, highly aggressive supply chain campaign targeting npm and PyPI ecosystems. Recent high-profile compromises include targeted waves within the @redhat-cloud-services and @tanstack namespaces.
Many developers are currently reporting that Windows Defender is blocking local database migrations or locking up the Prisma ORM CLI (specifically affecting prisma versions 7.7.0 and 7.8.0), attributing it to a Shai-Hulud infection.
*This specific Prisma flag is an upstream False Positive. Microsoft recently pushed a broad heuristic signature update to catch polymorphic Miasma scripts, which accidentally matched benign, authentic code within official Prisma packages. Independent audits of the official Prisma releases have confirmed no malicious code is present. However, because Defender quarantines the binaries, local execution (prisma db push, prisma migrate) is actively failing for many teams.
If Windows Defender has quarantined your Prisma binaries and is actively blocking commands like prisma db push or prisma migrate, Microsoft has provided the following official steps to clear the cached false positive detection and pull down the clean malware definitions.
cd c:\Program Files\Windows Defender
MpCmdRun.exe -removedefinitions -dynamicsignatures
MpCmdRun.exe -SignatureUpdate
Once completed, your local engine binaries should be cleared, allowing your Prisma migrations and deployment pipelines to run normally without throwing security errors.
While this specific Prisma flag was a false alarm, we strongly advise development teams to remain vigilant regarding general package ecosystem health:
node_modules/ or workspace directory to resolve it. Doing so exposes your environment to actual supply chain risks. Use the MpCmdRun.exe utility shown above instead..env files.NodeByte will continue monitoring edge telemetry and downstream package registries to ensure our hosting environments remain secure. If you have questions regarding your specific infrastructure deployment, please reach out to our support team.