Miasma: Supply Chain Attack Targeting RedHat npm Packages

What it is

Miasma ("The Spreading Blight") is a npm supply-chain compromise that Wiz Research identified on 1 June 2026 affecting packages under the @redhat-cloud-services namespace. At least 32 package releases contained unauthorized modifications not matching their source repos; these packages average ~80,000 weekly downloads. The payload is a variant of the (Mini) Shai-Hulud malware open-sourced by TeamPCP, re-themed from Dune references to Greek mythology (e.g. "spartan"). A follow-up wave (4 June) added packages abusing binding.gyp to execute code at install time.

How it works

Compromised packages shipped a preinstall script that automatically ran a malicious index.js at install. The payloads are large, heavily obfuscated JS using eval() and ROT-based decoding. Two behavioral changes distinguish this variant from prior Shai-Hulud:

• New cloud-identity collectors for GCP and Azure that enumerate all identities the infected machine can access — a shift from secret extraction toward gaining access to the cloud itself.
• Per-infection encryption: each infection generates a uniquely encrypted payload, so hash-based IOCs are useful only for one specific package version, defeating hash tracking.

Infected machines create repositories with the description "Miasma: The Spreading Blight."

Root cause

A specific Red Hat employee GitHub account was compromised and used to push malicious orphan commits to two RedHatInsights repositories, bypassing code review, across two waves. The commits added a minimal workflow triggering on push to any branch that requested GitHub's OIDC token (id-token: write), then ran an obfuscated _index.js that published packages with valid SLSA provenance attestations — mirroring TeamPCP's prior Tanstack attack. Valid provenance means the attestation alone does not vouch for integrity here.

What to do

• Audit developer workstations, CI/CD, and repos for the affected packages, GitHub Actions, and VSCode extensions.
• Review GitHub activity for unauthorized repositories, newly created access tokens, and suspicious workflow executions.
• Assume exposure and rotate GitHub tokens, SSH keys, cloud credentials, and CI/CD secrets.
• Longer term: dependency allowlisting, SBOM generation, package verification, and monitoring of developer/build environments.

Caveats

Attribution is deliberately hedged. Because TeamPCP publicly released the Mini Shai-Hulud code and details, Wiz treats the overlap as TTP similarity, not confirmed attribution — a copycat leveraging the public tooling cannot be ruled out. Revocation was incremental (2 malicious versions still live at the first update), so an audit should not assume the registry is fully cleaned.