Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
Miasma hit Red Hat npm packages with a worm that steals secrets, targets CI/CD systems, and can spread through compromised credentials.
Intelligence analysis by GPT-5.4 Mini
A new supply-chain campaign called Miasma compromised multiple @redhat-cloud-services npm packages and used install-time code to harvest developer secrets. The malware also tried to persist, exfiltrate data, and propagate through GitHub and CI/CD workflows.
A bad package got hidden inside some software tools developers install. When people put it on their computers, it looked for keys, passwords, and other secrets, then tried to send them away.
It was a bit like a burglar not only stealing from one house, but also leaving behind copies of itself so it could sneak into more houses later. It even tried to hide as a normal update so people would trust it.
The scary part is that it could reach work systems that build and ship software. That means one bad package could help an attacker learn secrets, sneak into cloud accounts, and spread through many projects.
Analysis
What happened
Security researchers say a campaign codenamed Miasma compromised several @redhat-cloud-services npm packages and turned them into a credential-stealing worm. The attack resembles the earlier Mini Shai-Hulud pattern: malicious code runs at install time, looks for secrets, and then uses stolen access to spread further.
What the malware did
The affected packages reportedly contained an obfuscated preinstall hook. According to the article, that hook searched developer machines and CI/CD environments for GitHub Actions secrets, npm tokens, cloud credentials, Kubernetes and Vault material, SSH keys, Git credentials, and other sensitive files. Researchers also said the malware used encrypted exfiltration logic, sent data to api.anthropic[.]com:443/v1/api, and fell back to GitHub when needed.
The article says the malware did more than steal secrets. It checked for security tools such as CrowdStrike, SentinelOne, Carbon Black, and StepSecurity Harden-Runner before acting. It also tried to establish persistence by adding hooks for Anthropic Claude Code and a VS Code tasks.json entry that runs on folder open. SafeDep said it also attempted privilege escalation through a container that bind-mounts /etc/sudoers.d and grants passwordless sudo.
How it spread
Several researchers cited in the article said the malware enumerated writable repositories, read workflow files, and used GitHub API actions to create commits that looked verified and signed. OX Security said the first commit with the string Miasma: The Spreading Blight appeared on May 29, 2026, suggesting the activity may have started then or was being tested around that time. Wiz said the newest variant added collectors for GCP and Azure identities and generated a uniquely encrypted payload per infection, making detection harder.
Attribution and response
The article says attribution is unclear because TeamPCP allegedly open-sourced tools linked to the Shai-Hulud worm, making it easier for other actors to copy the playbook. Researchers recommend isolating affected hosts, removing malicious package versions, rotating exposed credentials, reviewing GitHub and npm activity, and checking for persistence artifacts. Socket warned that deleting node_modules alone is not enough cleanup, especially if the malware already touched CI/CD or release workflows.
Key points
- Miasma compromised multiple `@redhat-cloud-services` npm packages and used install-time execution to steal secrets.
- Researchers said the malware targeted GitHub Actions secrets, cloud credentials, SSH keys, and other sensitive files.
- The campaign used encrypted exfiltration, GitHub fallbacks, and persistence hooks for developer tools.
- Wiz said the latest variant added GCP and Azure identity collectors and unique encryption per infection.
- The article recommends isolating hosts, rotating credentials, and checking CI/CD and GitHub for persistence or malicious commits.
The incident has a clear response playbook: isolate affected hosts, rotate exposed secrets, and audit for persistence artifacts. If teams act quickly, they may contain the compromise before malicious changes reach releases or downstream artifacts.
Because the malware targets developer machines, CI/CD, and GitHub workflows, a simple package uninstall may leave the deeper compromise in place. If exposed credentials or signed-looking commits were already used, attackers could retain access and poison future builds.
