Miasma Supply-Chain Attack Infects Red Hat npm Packages with Credential-Stealing Worm
Security researchers have identified a fresh supply-chain assault, dubbed Miasma, that has injected malicious code into several @redhat-cloud-services npm packages. The payload is designed to siphon credentials and secrets from developer systems and to deliver a self-replicating worm that can further contaminate downstream ecosystems.
Analysts liken Miasma to a smaller-scale Shai-Hulud-style campaign, noting it reuses key tactics such as running at install time, harvesting credentials, targeting CI/CD pipelines, encrypting stolen data for exfiltration, and enabling subsequent spread.
TeamPCP - a prolific cybercrime group linked to the Shai-Hulud worm - has publicly released tooling associated with that malware, which lowers the barrier for other actors to copy the technique and muddles efforts to pin the operation on a specific actor.
The compromised packages identified so far include:
@redhat-cloud-services/vulnerabilities-client, @redhat-cloud-services/tsc-transform-imports, @redhat-cloud-services/topological-inventory-client, @redhat-cloud-services/sources-client, @redhat-cloud-services/rule-components, @redhat-cloud-services/remediations-client, @redhat-cloud-services/rbac-clientCombined analysis from Aikido Security, JFrog, Microsoft, OX Security, SafeDep, StepSecurity, and Wiz shows the npm modules contain an obfuscated preinstall hook. That hook is tailored to collect a broad range of sensitive material: GitHub Actions secrets, npm tokens, cloud provider credentials, Kubernetes and Vault secrets, SSH private keys, Git credentials and other confidential files found on developer machines.
The malware includes a routine that encrypts the harvested material and transmits it to an attacker-controlled endpoint. The primary destination observed is api.anthropic[.]com:443/v1/api, with GitHub used as a backup channel for exfiltration - a clear attempt both to steal secrets and to weaponize them for contaminating the software supply chain.
The actor commits the encrypted exfiltration envelope through the GitHub API. In some commits the message contains a threatening string such as: “IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner:<token>”.
The malware also deliberately avoids running on systems configured for the Russian language, a behavior observed in prior GlassWorm supply-chain incidents. For npm installs, the payload invokes the OIDC token exchange and whoami endpoints, repackages an artifact (updateTarball / package-updated.tgz), and signs the resulting package using Sigstore, SafeDep reported. Stolen secrets are dumped into attacker-created public GitHub repositories whose descriptions include “Miasma: The Spreading Blight.” OX Security traces the first commit carrying that string to May 29, 2026, implying the variant was either live by then or being tested around that date.
When operating against GitHub, the malicious code enumerates repositories writable by the compromised token, reads action.yml/action.yaml via GraphQL, and uses the createCommitOnBranch mutation to introduce a workflow so the change shows up as a signed, verified commit. Additional malicious behaviors observed include attempting privilege escalation by launching a container that bind-mounts the host /etc/sudoers.d to grant the CI runner passwordless sudo; scanning for endpoint protection products such as CrowdStrike, SentinelOne, Carbon Black and StepSecurity Harden-Runner before carrying out harmful actions; and establishing persistence by injecting a SessionStart hook into Anthropic Claude Code and adding a .vscode/tasks.json entry with “runOn”: “folderOpen” so the malware executes whenever a Visual Studio Code project is opened.
Investigators say the initial compromise appears to stem from one Red Hat employee’s GitHub account. That account allegedly pushed malicious orphan commits to two RedHatInsights repositories, bypassing standard code review, and was used to inject the payload into the affected packages.
Recommended remediation steps include isolating any hosts that installed the tainted package versions, removing the compromised package releases, rotating exposed credentials, and scanning for suspicious activity on both GitHub and npm. Teams should also audit environments for persistence artifacts and configuration changes such as edits to
~/.claude/settings.json.vscode/tasks.json.github/workflows/codeql.yml.github/setup.js
and enforce stronger access controls.
Because the malware can run in the background and install developer-tool persistence mechanisms, simply uninstalling the npm package or deleting node_modules is not adequate. For CI/CD environments, affected workflow runs should be suspended, build artifacts produced during the exposure window invalidated, and organizations should review whether any releases, container images, npm packages, or deployment artifacts were created after the malicious package was installed.