Miasma Campaign Uses Red Hat npm Packages to Steal Developer Secrets
Summary
Researchers report that the Miasma campaign used compromised Red Hat npm packages to steal developer credentials and cloud secrets, abuse CI/CD workflows, and persist in developer tools. Evidence points to a compromised employee GitHub account; attribution remains incon
Key points
- Researchers report that multiple @redhat-cloud-services npm packages contained an obfuscated preinstall hook designed to collect credentials and secrets.
- The malware targets GitHub Actions, npm, cloud and Kubernetes credentials, Vault material, SSH keys, and Git credentials.
- Researchers describe encrypted exfiltration via the GitHub API and attacker-created public repositories, with GitHub also used as a fallback.
- The malware can alter GitHub workflows and establish persistence through Claude Code and Visual Studio Code configuration.
- Wiz researchers say this variant adds GCP and Azure identity collectors and generates a uniquely encrypted payload for each infection.
- Evidence suggests a compromised Red Hat employee GitHub account was used to push malicious commits; the threat actor remains unknown.
- Recommended response includes isolating affected hosts, removing malicious package versions, rotating exposed credentials, and reviewing persistence and CI/CD activity.
Article Details
- Attack Vectors
- Compromised @redhat-cloud-services npm packages used an obfuscated preinstall hook to execute malware on installation.
- The payload collected GitHub Actions secrets, npm tokens, cloud credentials, Kubernetes and Vault material, SSH keys, Git credentials, and other sensitive files.
- The malware encrypted stolen data and exfiltrated it through GitHub API commits to attacker-created public repositories; the article also reports transmission to api.anthropic[.]com:443/v1/api.
- Using stolen access, the malware enumerated writable GitHub repositories, read workflow files, and committed a workflow through the GitHub API.
- The payload attempted privilege escalation by launching a container that bind-mounted the host’s /etc/sudoers.d and granted the CI runner passwordless sudo.
- It checked for endpoint protection before malicious actions, avoided execution on Russian-language systems, and established persistence through Claude Code and Visual Studio Code configuration hooks.
- Defensive Notes
- Isolate hosts that installed affected package versions and remove the malicious versions.
- Rotate exposed credentials and review GitHub and npm activity for suspicious actions.
- Audit configuration files for persistence artifacts, including ~/.claude/settings.json, .vscode/tasks.json, .github/workflows/codeql.yml, and .github/setup.js.
- For CI/CD systems, suspend affected workflow runs, invalidate build artifacts created during the exposure window, and review releases, container images, packages, and deployments created after installation.
- Do not treat uninstalling the npm package or deleting node_modules as sufficient cleanup; the article warns that background execution and developer-tool persistence may remain.
MITRE ATT&CK
T1059.007 · JavaScriptThe compromised npm packages used an obfuscated preinstall hook to execute the malware.T1195.001 · Compromise Software Dependencies and Development ToolsMalicious code was introduced through compromised @redhat-cloud-services npm packages and executed by their preinstall hooks.T1518.001 · Security Software DiscoveryBefore malicious actions, the payload checked for endpoint protection from CrowdStrike, SentinelOne, Carbon Black, and StepSecurity Harden-Runner.T1546 · Event Triggered ExecutionThe malware established persistence using a Claude Code SessionStart hook and a Visual Studio Code task configured to run when a folder opens.T1548.003 · Sudo and Sudo CachingThe container-based privilege escalation attempt sought to grant the CI runner passwordless sudo.T1552.001 · Credentials In FilesThe malware collected credentials and secrets from sensitive files on developer machines.T1552.004 · Private KeysThe malware collected SSH keys from infected developer machines.T1567.001 · Exfiltration to Code RepositoryThe malware exfiltrated encrypted data through GitHub API commits to attacker-created public repositories.T1610 · Deploy ContainerThe malware attempted privilege escalation by launching a container with a host /etc/sudoers.d bind mount.T1614.001 · System Language DiscoveryThe malware avoided execution on Russian-language systems.
Malware
Vendors
AnthropicLike observed in prior Mini Shai-Hulud waves, the malware also contains encrypted exfiltration logic that transmits the data to “api.anthropic[.]com:443/v1/api” and uses GitHub as a fallback mechanism.MicrosoftPer analyses from Aikido Security, JFrog, Microsoft, OX Security, SafeDep, StepSecurity, and Wiz, the npm packages contain an obfuscated preinstall hook that’s designed to collect GitHub Actions secrets, npm tokens,Red HatResearchers say the malware uses install-time execution, encrypted exfiltration, CI/CD targeting, and persistence tricks, with evidence linking the intrusion to a compromised Red Hat employee GitHub account.
Products
Azure“Specifically, collectors for GCP and Azure identities were added that collect all identities the infected machine has access to.Claude CodeEstablish persistence by injecting a SessionStart hook to Anthropic Claude Code and a tasks.json with “runOn”: “folderOpen” for Microsoft Visual Studio Code projects so that the malware is automatically launched duringGCP“Specifically, collectors for GCP and Azure identities were added that collect all identities the infected machine has access to.GitHubResearchers say the malware uses install-time execution, encrypted exfiltration, CI/CD targeting, and persistence tricks, with evidence linking the intrusion to a compromised Red Hat employee GitHub account.GitHub ActionsThe payload targets GitHub Actions, CI/CD workflows, and developer tools for persistence.KubernetesThe malware steals GitHub, npm, cloud, Kubernetes, Vault, SSH, and Git credentials.npmMini Shai-Hulud supply chain campaign, codenamed Miasma, has compromised multiple @redhat-cloud-services npm packages to steal credentials and secrets from developer machines while also planting a self-propagatingVaultThe malware steals GitHub, npm, cloud, Kubernetes, Vault, SSH, and Git credentials.VSCodehook to Anthropic Claude Code and a tasks.json with “runOn”: “folderOpen” for Microsoft Visual Studio Code projects so that the malware is automatically launched during every session