Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign

Issuer: Adverse Trace Date issued: 2026-06-03 Version: 1.0

1. Executive summary

A sophisticated supply chain attack dubbed "Miasma" has compromised 32 npm packages within the @redhat-cloud-services scope, affecting over 90 versions. The intrusion originated from the upstream RedHatInsights/javascript-clients CI/CD pipeline, allowing attackers to publish trojanized packages with authentic GitHub Actions OIDC provenance signatures. Upon installation, a preinstall hook executes a multi-stage dropper that harvests credentials from GitHub Actions, AWS, Azure, GCP, HashiCorp Vault, and local developer environments, while attempting lateral propagation via repository forgery. For EMEA financial services, the immediate risk involves the potential compromise of CI/CD pipeline secrets, cloud infrastructure access, and the integrity of downstream software artifacts relying on these dependencies.

2. Regulatory framing

3. Attack chain

1. Pipeline Compromise: Attackers compromised the RedHatInsights/javascript-clients CI/CD pipeline, utilizing legitimate GitHub Actions OpenID Connect (OIDC) workflows to publish malicious packages.
2. Trojanized Publication: 32 packages under the @redhat-cloud-services scope were published with valid SLSA provenance signatures, masking the compromise.
3. Preinstall Trigger: Installation of any affected package triggers a preinstall hook defined in package.json.
4. Dropper Execution: The hook executes a 4.29 MB heavily obfuscated JavaScript dropper (index.js).
5. Runtime Deployment: The dropper decrypts AES-128-GCM encrypted blobs, downloads the Bun JavaScript runtime, and executes the secondary payload via Bun to evade Node.js-specific monitoring.
6. Credential Harvesting: The payload scans process memory (specifically Runner.Worker PID on Linux) to extract GitHub Actions secrets, SSH keys, CLI credentials, and cloud provider tokens (AWS, Azure, GCP, Vault).
7. Privilege Escalation: On Linux systems, the malware attempts to inject passwordless sudo rules via /etc/sudoers.d.
8. Exfiltration & Propagation: Stolen credentials are exfiltrated to attacker-controlled GitHub repositories (Channel A). The malware attempts to propagate by injecting malicious code (.github/setup.js) into non-protected branches of victim-owned repositories (Channel B).

Unconfirmed steps: While the primary payload includes a dormant HTTPS sender configured for api.anthropic.com, current analysis indicates this path is disabled (noop: true) in the observed samples. Attribution to specific threat actor groups remains unconfirmed; the campaign marker "Miasma: The Spreading Blight" is present, but linkage to prior "Shai-Hulud" variants is based on TTP similarity rather than confirmed infrastructure overlap.

4. Recommended actions

P1: Immediate (Within 24 Hours) * Audit Dependencies: Scan all package-lock.json and yarn.lock files for the specific malicious versions listed in Section 5. Remove or pin to known-good versions immediately. * Rotate Credentials: Assume compromise of any environment where affected packages were installed. Rotate: * GitHub Personal Access Tokens (PATs) and OAuth apps. * AWS Access Keys, Azure Service Principals, and GCP Service Account keys. * SSH keys located in ~/.ssh/. * NPM tokens (~/.npmrc). * Inspect CI/CD Runners: Check GitHub Actions runners for unauthorized processes. Look for bun execution chains originating from npm install. * Review Repository Activity: Audit GitHub audit logs for unauthorized commits to .github/setup.js or creation of new repositories with randomized names (pattern: adjective-creature-<0–99999>).

P2: Containment & Forensics (Within 72 Hours) * Process Monitoring: Deploy detection rules for the process chain: node → shell → bun → [obfuscated script]. * File System Hunt: Search for the injection of passwordless sudo rules: echo 'runner ALL=(ALL) NOPASSWD:ALL' in /etc/sudoers.d/. * Network Analysis: Monitor for outbound connections to api.anthropic.com or unusual GitHub API traffic utilizing python-requests/2.31.0 user-agents from build agents. * Memory Analysis: If possible, capture memory dumps of CI/CD runners to check for secrets extracted via /proc/[pid]/cmdline scraping.

P3: Remediation & Hardening (Within 7 Days) * Pin Dependencies: Enforce strict version pinning in package.json (remove caret ^ and tilde ~ ranges) for all critical dependencies. * Protect Branches: Ensure all critical repositories have branch protection rules enabled to prevent direct pushes to default branches and require status checks. * OIDC Review: Review GitHub Actions OIDC trust policies to ensure least-privilege access to cloud resources. * Supply Chain Verification: Implement SLSA level 3+ verification for internal builds to detect provenance forgery attempts.

5. Indicators of compromise

Note: Specific malicious package versions are extensive. Clients must cross-reference their lockfiles against the full list provided in the primary source (Microsoft) covering 32 packages including types, frontend-components, rbac-client, and chrome.

6. Sources

• Microsoft Threat Intelligence, "Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign," 2026-06-02. URL
• Snyk Vulnerability Blog, "Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages." URL
• BleepingComputer, "Red Hat npm packages compromised to steal developer credentials." URL
• Step Security, "Multiple redhat-cloud-services npm Packages compromised." URL
• Help Net Security, "Red Hat npm packages compromised in new Mini Shai-Hulud malware wave," 2026-06-02. URL

7. Adverse Trace position

We assess the severity of this incident as Critical for organizations utilizing the @redhat-cloud-services namespace or any transitive dependencies thereof. The combination of valid OIDC signatures, multi-stage obfuscation, and active credential harvesting from CI/CD environments represents a high-fidelity threat to cloud infrastructure integrity. The ability of the malware to forge SLSA provenance and propagate laterally via repository injection significantly expands the blast radius beyond the initial compromise. Adverse Trace is actively monitoring for secondary waves targeting similar CI/CD pipelines and will update this advisory if attribution confidence increases or new IOCs emerge. Clients should treat any exposure to the listed package versions as a confirmed breach of their build environment.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.