Red Hat npm Packages Compromised in Supply-Chain Attack Distributing Miasma Malware
Security researchers at Aikido and OX Security uncovered a supply-chain attack targeting over 30 npm packages under Red Hat’s @redhat-cloud-services namespace, distributing a new variant of the Shai-Hulud credential-stealing malware, dubbed "Miasma." The compromised packages, which collectively receive 117,000 weekly downloads, were backdoored to exfiltrate sensitive data, including developer credentials, cloud secrets, SSH keys, CI/CD tokens, and environment files.
Red Hat confirmed the incident, stating that the affected packages were limited to internal development tooling and were removed from the npm registry upon discovery. The company emphasized that the malicious code never reached customer-facing systems via console.redhat.com and that no impact on production environments or customer data has been identified. However, the root cause of the compromise including how the attacker gained access remains under investigation.
The attack leveraged a compromised GitHub account belonging to a Red Hat employee, which was used to push malicious commits to multiple repositories. These commits introduced a GitHub Actions workflow that abused npm’s publishing mechanism to release backdoored versions of the packages. When installed, the packages executed a preinstall script triggering a 4.2 MB obfuscated index.js payload, designed to harvest credentials from AWS, Google Cloud, Azure, HashiCorp Vault, Kubernetes, npm, PyPI, Docker, GPG keys, and .env files.
A total of 32 packages and 96 versions were affected, all under the @redhat-cloud-services namespace. The malware, Miasma, appears to be a modified version of the Mini Shai-Hulud framework, whose source code was leaked in May by the TeamPCP threat group. While Miasma shares core functionality with Mini Shai-Hulud such as credential theft it introduces enhanced obfuscation, multi-stage payload delivery, and expanded data exfiltration capabilities. The campaign has also compromised 309 GitHub repositories, leaving traces of the string "Miasma: The Spreading Blight" in affected code.
This incident follows a recent surge in Shai-Hulud-based supply-chain attacks, which have targeted high-profile projects like Bitwarden, SAP, Mistral, TanStack, OpenAI, and GitHub. The identity of the threat actor behind this attack remains unclear whether it is TeamPCP or another group repurposing the leaked malware.
SAP cybersecurity rating report: https://www.rankiteo.com/company/sap
"id": "SAP1780352800",
"linkid": "sap",
"type": "Cyber Attack",
"date": "5/2026",
"severity": "25",
"impact": "1",
"explanation": "Attack without any consequences"{'affected_entities': [{'industry': 'Technology, Software, Cloud Services',
'name': 'Red Hat',
'type': 'Company'}],
'attack_vector': 'Compromised GitHub account, malicious GitHub Actions '
'workflow, backdoored npm packages',
'customer_advisories': 'No impact on customer-facing systems or production '
'environments',
'data_breach': {'data_exfiltration': True,
'file_types_exposed': ['.env files'],
'sensitivity_of_data': 'High (credentials, secrets, keys)',
'type_of_data_compromised': ['Developer credentials',
'Cloud secrets',
'SSH keys',
'CI/CD tokens',
'Environment files',
'AWS/Google Cloud/Azure '
'credentials',
'HashiCorp Vault secrets',
'Kubernetes tokens',
'npm/PyPI/Docker credentials',
'GPG keys']},
'description': 'Security researchers at Aikido and OX Security uncovered a '
'supply-chain attack targeting over 30 npm packages under Red '
'Hat’s @redhat-cloud-services namespace, distributing a new '
'variant of the Shai-Hulud credential-stealing malware, dubbed '
'Miasma. The compromised packages were backdoored to '
'exfiltrate sensitive data, including developer credentials, '
'cloud secrets, SSH keys, CI/CD tokens, and environment files.',
'impact': {'data_compromised': 'Developer credentials, cloud secrets, SSH '
'keys, CI/CD tokens, environment files, '
'AWS/Google Cloud/Azure credentials, HashiCorp '
'Vault secrets, Kubernetes tokens, '
'npm/PyPI/Docker credentials, GPG keys, .env '
'files',
'identity_theft_risk': 'High (credential theft)',
'operational_impact': 'Internal development tooling compromised, '
'no impact on customer-facing systems or '
'production environments',
'systems_affected': '32 npm packages (96 versions) under '
'@redhat-cloud-services namespace, 309 GitHub '
'repositories'},
'initial_access_broker': {'backdoors_established': 'Malicious GitHub Actions '
'workflow, backdoored npm '
'packages',
'entry_point': 'Compromised GitHub account of a Red '
'Hat employee'},
'investigation_status': 'Ongoing (root cause under investigation)',
'motivation': 'Credential theft, data exfiltration',
'post_incident_analysis': {'root_causes': 'Compromised GitHub account, abuse '
'of npm publishing mechanism'},
'ransomware': {'data_exfiltration': True},
'references': [{'source': 'Aikido Security'}, {'source': 'OX Security'}],
'response': {'communication_strategy': 'Public disclosure of incident, '
'confirmation of no customer impact',
'containment_measures': 'Removed compromised packages from npm '
'registry',
'remediation_measures': 'Investigation into root cause, removal '
'of malicious code',
'third_party_assistance': 'Aikido, OX Security'},
'title': 'Red Hat npm Packages Compromised in Supply-Chain Attack '
'Distributing Miasma Malware',
'type': 'Supply-Chain Attack',
'vulnerability_exploited': 'Compromised developer account, abuse of npm '
'publishing mechanism'}