Miasma Worm Compromises 32 Red Hat npm Packages, Steals Cloud Credentials, and Spreads Through CI/CD Pipelines
On June 1, 2026, security researchers discovered that at least 32 package releases under the @redhat-cloud-services npm namespace had been injected with unauthorized malicious code [1]. The packages collectively pull roughly 80,000 weekly downloads [1]. The campaign is identified by the string "Miasma: The Spreading Blight," which appears in the descriptions of attacker-created GitHub repositories used for data exfiltration. The malware belongs to the Mini Shai-Hulud worm family [2]. It steals credentials across AWS, GCP, and Azure environments, enumerates cloud identities, and propagates laterally through developer workstations and CI/CD runners. Most malicious versions were reportedly revoked within hours of discovery on June 1, though some may have remained available briefly during initial public reporting [1].
Red Hat published advisory RHSB-2026-006 confirming awareness of the incident. According to the advisory, no Hybrid Cloud Console release shipped during the compromise window, and managed cloud services including ARO, OpenShift Dedicated, ROSA, ACS Cloud Service, and AAP on Cloud were unaffected.
Background: TeamPCP and the Shai-Hulud Lineage
Miasma is not a novel creation. The threat actor group TeamPCP has been running targeted CI/CD supply chain attacks for several months [2]. TeamPCP open-sourced the underlying Shai-Hulud attack framework earlier in 2026. That same framework powered multiple prior supply chain compromises including TanStack, Bitwarden CLI, Mistral, Microsoft's Durable Task, PyTorch Lightning, and Intercom [2], which followed an identical playbook: turning CI/CD infrastructure into the primary attack surface.
CISA issued warnings about related supply chain campaigns targeting GitHub Action workflows.
Miasma represents a meaningful upgrade over its Mini Shai-Hulud predecessor. The most significant change is a pair of new collectors for GCP and Azure that enumerate every identity the infected host can assume, not just static secrets stored on disk. This is a shift from harvesting credentials to mapping the full scope of cloud access available from a compromised machine: service accounts, managed identities, federated tokens, and assumed roles.
Initial Access: Stolen Credentials and Session Hijacking
The attack chain started with a compromised Red Hat employee GitHub account. Whiteintel reportedly detected Red Hat GitHub credentials and a session cookie in infostealer logs from April and May 2026. The first malicious modifications appeared on or around May 29, 2026, roughly two weeks after the second credential exposure.
The attackers did not publish directly to npm using stolen npm tokens. Instead, the malicious packages were pushed through GitHub Actions OIDC tokens, meaning the CI/CD pipeline itself was the vector for package publication. OIDC-based publishing was designed to eliminate the risk of long-lived static tokens, but that protection collapses when an adversary controls the pipeline.
Payload Execution
The malicious payload is an obfuscated file that runs automatically during npm install. Reports indicate each infection receives a uniquely encrypted payload, which complicates signature-based detection.
Once triggered, the malware downloads the Bun runtime from GitHub releases rather than using the local Node.js installation. This is a deliberate evasion technique: many endpoint detection tools and CI/CD security scanners monitor Node.js process trees but do not flag Bun execution. The malware creates transient files in /tmp/ and uses a lock file to prevent duplicate instances on the same host.
Credential Collection Targets
The credential harvesting component is broad and aggressive. Known targets include:
- GitHub Actions secrets:
GITHUB_TOKENandACTIONS_RUNTIME_TOKEN - AWS credentials: standard environment variables and credential files
- GCP identities: enumerated via the metadata service, reportedly using a spoofed Google API client user-agent string
- Azure identities: collected through newly added Azure-specific modules
- Shell environment variables: full dump of the execution environment
- GitHub CLI tokens: extracted via
gh auth token - AI developer tool configurations: including configuration files for AI coding assistants
The GCP collector is particularly notable. By spoofing a legitimate Google API client user-agent, the malware's metadata service requests blend into normal traffic patterns on GCP-hosted CI runners. The Azure collector is entirely new to this variant and was not present in earlier Shai-Hulud releases.
Propagation Mechanism
The worm component is what distinguishes Miasma from a standard supply chain implant. Once the malware has harvested GitHub tokens, it uses those tokens to enumerate repositories the compromised account can access, then attempts to inject itself into additional packages [2]. This creates a cascading infection pattern: a single compromised developer account can spread the worm across every repository and organization that account touches.
IOC Table
The original source material references the following indicators. No IP addresses, domains, or URLs were disclosed in public reporting. The indicators below are limited to malware identifiers confirmed in source analysis.
| Type | Indicator | Context |
|---|---|---|
| Malware Name | Miasma: The Spreading Blight | Campaign identifier found in attacker-created GitHub repository descriptions |
| Malware Family | Mini Shai-Hulud | Predecessor worm framework by TeamPCP, upon which Miasma is based [2] |
Note: Additional IOCs such as specific filenames, lock files, and configuration file paths have been reported in vendor analyses but could not be independently verified for this report. Defenders should consult the primary Wiz [1] and Socket research for complete IOC listings.
MITRE ATT&CK Mapping
Based on the reported behaviors:
| Technique ID | Name | Application |
|---|---|---|
| T1195.002 | Supply Chain Compromise: Compromise Software Supply Chain | Malicious code injected into legitimate npm packages |
| T1078 | Valid Accounts | Compromised GitHub account used as initial access |
| T1059.007 | Command and Scripting Interpreter: JavaScript | Payload executes via npm install hooks |
| T1552.001 | Unsecured Credentials: Credentials In Files | Harvesting of credential files, CLI tokens, and config files |
| T1552.005 | Unsecured Credentials: Cloud Instance Metadata API | GCP identity enumeration via metadata service with spoofed user-agent |
| T1027 | Obfuscated Files or Information | Obfuscated payload with per-infection encryption |
| T1105 | Ingress Tool Transfer | Downloads Bun runtime from GitHub releases |
| T1036.005 | Masquerading: Match Legitimate Name or Location | Spoofed Google API client user-agent string |
Detection and Hunting
npm Audit and Package Verification
Organizations consuming @redhat-cloud-services packages should immediately audit their package-lock.json and yarn.lock files for any versions published between May 29 and June 1, 2026. Pin to known-good versions and verify package integrity against npm's provenance attestations.
CI/CD Pipeline Monitoring
Look for unexpected downloads of the Bun runtime in CI runner logs. Bun is legitimate software, but its presence in pipelines that don't explicitly use it is anomalous.
# Splunk query for Bun runtime downloads in CI environments
index=proxy OR index=firewall dest_url="*github.com/oven-sh/bun/releases*"
| where NOT match(src_host, "expected-dev-workstation-pattern")
| stats count by src_host, dest_url, _timeLock File Detection
Monitor for the creation of unusual lock files in /tmp/ directories across build systems and developer workstations. Consult vendor reports [1] for specific filenames.
GCP Metadata Service Anomalies
On GCP-hosted runners, look for metadata service requests with unexpected or spoofed user-agent strings originating from processes that are not the expected Google client libraries.
GitHub Token Usage Auditing
Review GitHub audit logs for GITHUB_TOKEN usage patterns that don't match normal CI/CD workflows. The worm's propagation relies on using harvested tokens to access additional repositories, so unusual cross-repository activity from CI service accounts is a strong signal.
Analysis
The Miasma campaign demonstrates how infostealer-to-supply-chain attack chains have become operationally reliable. The gap between credential exposure in stealer logs (April/May 2026) and active exploitation (late May 2026) was measured in weeks. TeamPCP's decision to open-source the Shai-Hulud framework has likely lowered the barrier for this class of attack, and the Miasma variant shows active development: the new GCP and Azure identity enumeration modules are purpose-built for cloud-native development environments.
The OIDC publishing vector deserves particular attention. Many organizations adopted OIDC-based npm publishing specifically to reduce supply chain risk. Miasma demonstrates that pipeline compromise renders this control ineffective. The security boundary is not the token type; it is the integrity of the pipeline itself.
The reported targeting of AI coding assistant configuration files is also worth flagging. AI coding assistants are gaining access to sensitive codebases and infrastructure. Stealing their configuration files could grant access to API keys, workspace contexts, and permitted tool configurations that extend well beyond traditional developer credentials.
Red Sheep Assessment
Confidence: Moderate
We assess that the Miasma campaign represents the maturation of CI/CD supply chain attacks into a semi-automated, self-propagating model. Three observations stand out:
First, the infostealer-to-supply-chain pipeline is now a repeatable attack pattern. The Whiteintel detections of Red Hat credentials in stealer logs months before the compromise suggest either that TeamPCP operates its own stealer infrastructure or that it systematically purchases and triages stealer data for high-value developer accounts. Either scenario points to industrialized targeting.
Second, the shift from credential theft to identity enumeration changes the threat model. Stealing an AWS access key gives an attacker one set of permissions. Enumerating every assumable role and federated identity provides a map of the entire cloud access graph reachable from that host. This is likely reconnaissance for follow-on operations, not just credential harvesting.
Third, the open-sourcing of Shai-Hulud almost certainly means Miasma will not be the last variant. The framework provides a blueprint that other actors can adapt.
A contrarian read: Red Hat's advisory (RHSB-2026-006) states that no Hybrid Cloud Console release shipped during the compromise window and that managed cloud services were unaffected. The 80,000+ weekly downloads figure reflects total package popularity, not necessarily the number of installations that pulled compromised versions during the roughly 72-hour window. The actual number of affected downstream consumers may be significantly lower.
Defender's Checklist
- ▢[ ] Audit all
@redhat-cloud-servicespackage versions in your dependency trees against the known-compromised version list published by Wiz [1] and Aikido [2]. Remove or pin to verified clean versions immediately. - ▢[ ] Hunt for unusual lock files or transient files in
/tmp/across all CI/CD runners and developer workstations. Consult vendor IOC reports for specific filenames. - ▢[ ] Review GitHub audit logs for cross-repository actions by CI service accounts that fall outside normal workflow patterns, particularly between May 29 and June 5, 2026.
- ▢[ ] Check CI/CD runner logs for unexpected Bun runtime downloads from
github.com/oven-sh/bun/releasesand investigate any hits. - ▢[ ] Rotate all GitHub tokens, cloud credentials, and AI tool API keys on any system that installed
@redhat-cloud-servicespackages during the compromise window.
References
Note: The following references correspond to the source attributions used throughout this article. The original research and reporting were conducted by the organizations cited.
[1] Wiz Research, "Miasma: Analysis of the @redhat-cloud-services npm compromise," June 2026. Available: https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages
[2] Aikido Security, "Miasma campaign: 96 compromised versions across 32 packages," June 2026. Available: https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm