Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
Summary: A Mini Shai-Hulud supply chain campaign codenamed Miasma compromised @redhat-cloud-services npm packages with an obfuscated preinstall hook that harvests GitHub Actions secrets, npm tokens, cloud credentials, Kubernetes and Vault material, SSH keys, and Git credentials, then exfiltrates them to api.anthropic[.]com:443/v1/api with GitHub as a fallback. Evidence points to a compromised Red Hat employee's GitHub account as patient zero, used to push malicious orphan commits to two RedHatInsights repositories and bypass code review, with Whiteintel reporting a Red Hat GitHub credential and session cookie in infostealer logs on April 13 and May 15, 2026.
Bottom line: The malware commits stolen, encrypted data to attacker-created public GitHub repositories and signs workflow changes through createCommitOnBranch so they appear verified, meaning a clean uninstall of the npm package or deleting node_modules is not sufficient cleanup. With TeamPCP having open-sourced the Shai-Hulud tooling, attribution is harder and any organization running these packages in CI/CD must treat build artifacts produced during the exposure window as potentially compromised.
Read the original at The Hacker News ↗
- Topics
- Supply Chain & AppSec
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026