Miasma — @redhat-cloud-services npm Supply Chain Compromise (Mini Shai-Hulud Variant, GitHub Actions OIDC/SLSA Abuse with GCP/Azure Cloud-Identity Theft) — Threadlinqs Intelligence
As of 2026-06-01, Miasma — @redhat-cloud-services npm Supply Chain Compromise (Mini Shai-Hulud Variant, GitHub Actions OIDC/SLSA Abuse with GCP/Azure Cloud-Identity Theft) is a critical-severity supply chain threat attributed to TeamPCP, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 27 indicators of compromise.
Threat ID: TL-2026-0643 · Severity: CRITICAL · Status: ACTIVE · Category: SUPPLY_CHAIN
Attribution: TeamPCP · FINANCIAL
On 1 June 2026 Wiz Research identified a supply chain compromise of the @redhat-cloud-services npm namespace in which at least 32 package releases (~80,000 cumulative weekly downloads) were trojanized
Miasma is the first observed variant of TeamPCP's 'Mini Shai-Hulud' self-propagating npm worm to target the @redhat-cloud-services namespace, discovered by Wiz Research at approximately 13:00 UTC on 1 June 2026. The variant is largely a cosmetic reskin of Mini Shai-Hulud: the Dune-universe references that characterized the original Shai-Hulud lineage are replaced with Greek-mythology themes (e.g. 'spartan'), and the attacker repository carries the description 'Miasma: The Spreading Blight'. Underlying functionality and tradecraft remain substantially identical to the campaign that compromised TanStack, Mistral AI, OpenSearch, Guardrails AI and UiPath in May 2026 (related chain tracked as CVE-2026-45321, CVSS 9.6).
ROOT CAUSE / DELIVERY: Rather than a stolen npm token, the operators compromised a Red Hat employee GitHub account and used it to push malicious orphan commits to at least three RedHatInsights repositories (frontend-components, javascript-clients, platform-frontend-ai-toolkit) on attacker-created branches following an 'oidc-<8 hex>' naming pattern, bypassing code review. A minimal injected GitHub Actions workflow triggered on push to any branch, requested a GitHub OIDC identity token via 'id-token: write', and executed an obfuscated '_index.js' that exchanged the OIDC token directly with npm for publish credentials. Because publication occurred through legitimate CI infrastructure, the malicious releases carry valid SLSA Build Level 3 provenance attestations generated through the Sigstore stack (Fulcio signing certificate + Rekor transparency log, in-toto statements with the standard GitHub Actions build type) — defeating provenance-based trust signals.
INSTALL-TIME EXECUTION: Each poisoned package ships a 'preinstall': 'node index.js' lifecycle hook, so the payload executes automatically whenever a developer or CI runner installs the dependency. index.js is an unusually large (~4.2 MB) heavily obfuscated JavaScript file using eval() and ROT-based string decoding to conceal functionality, consistent with the obfuscator.io string-table + secondary-cipher layering documented across the Mini Shai-Hulud family.
CREDENTIAL & CLOUD-IDENTITY HARVESTING: The payload sweeps CI/CD secrets (GitHub Actions GITHUB_TOKEN, ACTIONS_RUNTIME_TOKEN, and — in the family — runner-process memory scraped from /proc/{pid}/mem for {"value":...,"isSecret":true} structures), npm/PyPI tokens, SSH keys, Docker and GPG credentials, .env files, and Kubernetes kubeconfigs. The defining evolution in Miasma is the addition of dedicated GCP and Azure cloud-identity collectors that enumerate every identity the infected host can reach: GCP application-default credentials and service-account key files (network calls bear the user-agent 'google-api-nodejs-client/7.0.0 gl-node/20.11.0 gccl/7.0.0'), Azure service-principal credentials and managed-identity tokens, alongside the family's existing AWS access-key/session-token theft via the IMDSv2 flow (169.254.169.254), ECS/Fargate task-metadata endpoint (169.254.170.2), and local HashiCorp Vault agent (127.0.0.1:8200). This marks a strategic shift from pure secret extraction toward leveraging cloud access itself.
PROPAGATION & C2: As a worm, the implant searches stolen npm tokens for ones with 2FA-bypass publish rights, enumerates other packages owned by the compromised maintainer, and re-publishes trojanized tarballs — extending spread beyond the initial namespace. Family C2 routes harvested data through the Session decentralized messaging network (filev2.getsession.org, RSA-4096-OAEP-wrapped AES-256-GCM) and a GitHub dead-drop using the GraphQL createCommitOnBranch mutation with Dependabot-mimicking branch names and 'chore: update dependencies' messages. Some family builds plant a destructive ransom tripwire: newly minted npm tokens are described 'IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner'.
ATTRIBUTION: Tradecraft overlaps strongly with TeamPCP's Mini Shai-Hulud campaign, but attribution is L
Weaknesses (CWE)
CWE-506, CWE-1357, CWE-829, CWE-522, CWE-285
Target sectors: technology, software-development, cloud-services, open-source, devops, enterprise-it
Target regions: Global, North America, Europe
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 27 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
SUPPLY_CHAIN, CRITICAL, threat intelligence, cybersecurity, T1195, T1078, T1199, T1587, T1059, T1554, T1546, T1027, T1140, T1656