Miasma Supply-Chain Attack Compromises Red Hat npm Packages

Summary

Wiz found 32 compromised Red Hat npm package releases. A hijacked employee account used GitHub Actions and OIDC to publish malware that steals developer secrets and collects GCP and Azure identities; most malicious versions were revoked.

Key points

At least 32 releases across the @redhat-cloud-services npm namespace contained unauthorized changes, affecting packages averaging about 80,000 weekly downloads.
A compromised Red Hat employee GitHub account pushed malicious orphan commits to repositories, bypassing code review and triggering publishing workflows on any branch.
The workflows obtained GitHub OIDC tokens and ran obfuscated JavaScript to publish affected packages with valid SLSA provenance attestations.
The payload, derived from Mini Shai-Hulud, runs during installation and targets developer secrets; added collectors gather accessible GCP and Azure identities.
The malware creates a uniquely encrypted payload per infection, making hash-based indicators useful only for specific package versions.
Wiz says the activity overlaps with TeamPCP tradecraft but cautions that public tooling means attribution is not definitive.
Most malicious versions had been revoked as of June 1, with two remaining at that time; the article advises auditing affected packages and build environments and rotating potentially exposed credentials.

Article Details

Attack Vectors: A compromised Red Hat employee GitHub account was used to push malicious orphan commits to RedHatInsights repositories, bypassing code review.
GitHub Actions workflows triggered on pushes to any branch, requested an OIDC identity token, and ran an obfuscated payload that published compromised npm packages.
Affected package versions ran malicious JavaScript through installation-time preinstall scripts.
Defensive Notes: Investigate developer workstations, CI/CD environments, and repositories for signs of compromise.
Audit for affected packages, GitHub Actions, VSCode extensions, unauthorized repositories, newly created access tokens, and suspicious workflow executions.
Assume GitHub tokens, SSH keys, cloud credentials, and CI/CD secrets may have been exposed, and rotate them.
Use dependency allowlisting, generate SBOMs, verify packages, and improve monitoring of developer and build environments.

Indicators of compromise

Type	Indicator	Context
SHA1	`608d01124cd6b5b8c55888e984b4c4d9b06fa686`	Commit identified in the article as a malicious orphan commit pushed to a RedHatInsights repository.
SHA1	`7569d69cf3684a792ce63d19b6e0d9d192597963`	Commit identified in the article as a malicious orphan commit pushed to a RedHatInsights repository.
SHA1	`8bf051251ec3b973e39a313547e53421a2f8d2f6`	Commit identified in the article as a malicious orphan commit pushed to a RedHatInsights repository.
SHA1	`ab9903d9edc720d1e11ea7d3d3e7a1c456f44ff7`	Commit identified in the article as a malicious orphan commit pushed to a RedHatInsights repository.