Red Hat npm Packages Compromised in Miasma Credential-Theft Campaign
Summary
Researchers say 32 Red Hat npm packages were backdoored with Miasma, a Shai-Hulud variant targeting developer credentials and cloud secrets. Red Hat removed the packages and reported no identified impact to customer or production environments.
Key points
- Aikido and OX Security reported 32 affected packages and 96 package versions in Red Hat’s @redhat-cloud-services namespace.
- The malicious preinstall script reportedly targeted developer credentials, cloud secrets, SSH keys, CI/CD tokens, and other sensitive data.
- Aikido said attackers allegedly used a compromised Red Hat employee GitHub account and GitHub Actions to publish poisoned packages through npm trusted publishing.
- Red Hat removed the packages and said the compromise was limited to internal development tooling, with no identified impact to customer or partner environments or production systems.
- Researchers linked Miasma to Shai-Hulud and noted similarities to Mini Shai-Hulud; attribution to TeamPCP remains unclear.
- OX Security reported that 309 GitHub repositories had been compromised by the campaign at the time of publication.
- Organizations that installed affected versions were advised to rotate credentials, secrets, and tokens used on infected devices.
Article Details
- Victim Organization
- Red Hat
- Incident Type
- Supply-chain compromise involving backdoored npm packages in Red Hat’s @redhat-cloud-services namespace.
- Data Types Exposed
- Developer credentials, cloud secrets, SSH keys, CI/CD tokens, and other sensitive information were targeted by the malware; actual exposure or theft was not confirmed.
- Operational Impact
- Aikido reported that 32 packages and 96 package versions were affected. Red Hat removed the packages and said the compromise was limited to internal development tooling; it had not identified impact to customer or partner environments or production systems. Researchers reported that 309 GitHub repositories had been compromised by the Miasma campaign.
- Ransom Or Extortion
- Unknown
- Claim Status
- confirmed
MITRE ATT&CK
Threat Actors
Malware
ChainDropRed Hat says the affected packages were limited to internal development tooling, but researchers report the campaign has already compromised 309 GitHub repositories and is linked to similarities with Mini Shai-Hulud.MiasmaMore than 30 npm packages in Red Hat’s @redhat-cloud-services namespace were compromised in a supply-chain attack that deployed the new Shai-Hulud variant “Miasma” to steal developer credentials and cloud secrets.Shai-HuludMore than 30 npm packages in Red Hat’s @redhat-cloud-services namespace were compromised in a supply-chain attack that deployed the new Shai-Hulud variant “Miasma” to steal developer credentials and cloud secrets.
Vendors
Products
GitHub ActionsThose commits added a GitHub Actions workflow and a script that abused npm’s publishing mechanism to release backdoored packages.npmMore than 30 npm packages in Red Hat’s @redhat-cloud-services namespace were compromised in a supply-chain attack that deployed the new Shai-Hulud variant “Miasma” to steal developer credentials and cloud secrets.