Miasma — @redhat-cloud-services npm Supply Chain Compromise (Mini Shai-Hulud Variant, GitHub Actions OIDC/SLSA Abuse with GCP/Azure Cloud-Identity Theft)

Miasma — @redhat-cloud-services npm Supply Chain Compromise (TL-2026-0643), also tracked as Miasma, is a critical-severity supply-chain compromise, first published 2026-06-01. It is attributed to TeamPCP with low confidence, affects Red Hat @redhat-cloud-services npm namespace, maps to 22 MITRE ATT&CK techniques (T1003, T1005, T1027), and is covered by 9 detection rules and 27 indicators of compromise.

Key facts for TL-2026-0643

Threat ID
TL-2026-0643
Also known as
Miasma, Miasma: The Spreading Blight, spartan, Mini Shai-Hulud (Greek-mythology variant)
Severity
CRITICAL
Status
ACTIVE
Category
SUPPLY_CHAIN
First published
2026-06-01
Last reviewed
2026-06-01
Attribution
TeamPCP
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
technology, software-development, cloud-services, open-source, devops, enterprise-it
Target regions
Global, North America, Europe
Detection rules
9
Indicators of compromise
27

Malware and tooling in Miasma — @redhat-cloud-services npm Supply Chain Compromise

Malware and tooling: Miasma, Mini Shai-Hulud, spartan

On 1 June 2026 Wiz Research identified a supply chain compromise of the @redhat-cloud-services npm namespace in which at least 32 package releases (~80,000 cumulative weekly downloads) were trojanized with a 'Miasma'/'spartan' variant of TeamPCP's open-sourced Mini Shai-Hulud worm. A compromised Red Hat employee GitHub account pushed malicious orphan commits to RedHatInsights repositories, and a minimal GitHub Actions workflow abused a GitHub OIDC id-token to publish the poisoned packages with valid SLSA provenance attestations. The payload runs at install time via a preinstall script, harvests CI/CD and cloud credentials, and adds new GCP and Azure cloud-identity collectors that enumerate every identity reachable from the infected machine.

How Miasma — @redhat-cloud-services npm Supply Chain Compromise works

Miasma is the first observed variant of TeamPCP's 'Mini Shai-Hulud' self-propagating npm worm to target the @redhat-cloud-services namespace, discovered by Wiz Research at approximately 13:00 UTC on 1 June 2026. The variant is largely a cosmetic reskin of Mini Shai-Hulud: the Dune-universe references that characterized the original Shai-Hulud lineage are replaced with Greek-mythology themes (e.g. 'spartan'), and the attacker repository carries the description 'Miasma: The Spreading Blight'. Underlying functionality and tradecraft remain substantially identical to the campaign that compromised TanStack, Mistral AI, OpenSearch, Guardrails AI and UiPath in May 2026 (related chain tracked as CVE-2026-45321, CVSS 9.6).

ROOT CAUSE / DELIVERY: Rather than a stolen npm token, the operators compromised a Red Hat employee GitHub account and used it to push malicious orphan commits to at least three RedHatInsights repositories (frontend-components, javascript-clients, platform-frontend-ai-toolkit) on attacker-created branches following an 'oidc-<8 hex>' naming pattern, bypassing code review. A minimal injected GitHub Actions workflow triggered on push to any branch, requested a GitHub OIDC identity token via 'id-token: write', and executed an obfuscated '_index.js' that exchanged the OIDC token directly with npm for publish credentials. Because publication occurred through legitimate CI infrastructure, the malicious releases carry valid SLSA Build Level 3 provenance attestations generated through the Sigstore stack (Fulcio signing certificate + Rekor transparency log, in-toto statements with the standard GitHub Actions build type) — defeating provenance-based trust signals.

INSTALL-TIME EXECUTION: Each poisoned package ships a 'preinstall': 'node index.js' lifecycle hook, so the payload executes automatically whenever a developer or CI runner installs the dependency. index.js is an unusually large (~4.2 MB) heavily obfuscated JavaScript file using eval() and ROT-based string decoding to conceal functionality, consistent with the obfuscator.io string-table + secondary-cipher layering documented across the Mini Shai-Hulud family.

CREDENTIAL & CLOUD-IDENTITY HARVESTING: The payload sweeps CI/CD secrets (GitHub Actions GITHUB_TOKEN, ACTIONS_RUNTIME_TOKEN, and — in the family — runner-process memory scraped from /proc/{pid}/mem for {"value":...,"isSecret":true} structures), npm/PyPI tokens, SSH keys, Docker and GPG credentials, .env files, and Kubernetes kubeconfigs. The defining evolution in Miasma is the addition of dedicated GCP and Azure cloud-identity collectors that enumerate every identity the infected host can reach: GCP application-default credentials and service-account key files (network calls bear the user-agent 'google-api-nodejs-client/7.0.0 gl-node/20.11.0 gccl/7.0.0'), Azure service-principal credentials and managed-identity tokens, alongside the family's existing AWS access-key/session-token theft via the IMDSv2 flow (169.254.169.254), ECS/Fargate task-metadata endpoint (169.254.170.2), and local HashiCorp Vault agent (127.0.0.1:8200). This marks a strategic shift from pure secret extraction toward leveraging cloud access itself.

PROPAGATION & C2: As a worm, the implant searches stolen npm tokens for ones with 2FA-bypass publish rights, enumerates other packages owned by the compromised maintainer, and re-publishes trojanized tarballs — extending spread beyond the initial namespace. Family C2 routes harvested data through the Session decentralized messaging network (filev2.getsession.org, RSA-4096-OAEP-wrapped AES-256-GCM) and a GitHub dead-drop using the GraphQL createCommitOnBranch mutation with Dependabot-mimicking branch names and 'chore: update dependencies' messages. Some family builds plant a destructive ransom tripwire: newly minted npm tokens are described 'IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner'.

ATTRIBUTION: Tradecraft overlaps strongly with TeamPCP's Mini Shai-Hulud campaign, but attribution is LOW confidence — TeamPCP publicly released the Mini Shai-Hulud source code, so a copycat reusing public tooling cannot be ruled out.

IMPACT: ~80,000 weekly downloads across 32 releases of a Red Hat-branded namespace widely consumed in console.redhat.com frontends and downstream cloud tooling. Any workstation or CI pipeline that installed an affected version between publication and revocation should treat all CI secrets, cloud credentials (AWS/GCP/Azure), SSH keys, and npm/PyPI tokens as compromised. As of the 14:00 UTC update most malicious versions were revoked, with 2 still live at time of reporting.

MITRE ATT&CK techniques used in TL-2026-0643

Credential Access

T1003 OS Credential Dumping; T1528 Steal Application Access Token; T1552 Unsecured Credentials

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1684.001 Impersonation

Execution

T1059 Command and Scripting Interpreter

Initial Access

T1078 Valid Accounts; T1195 Supply Chain Compromise; T1199 Trusted Relationship

Discovery

T1087 Account Discovery; T1526 Cloud Service Discovery; T1580 Cloud Infrastructure Discovery

Command and Control

T1102 Web Service; T1573 Encrypted Channel

Impact

T1485 Data Destruction

Persistence

T1546 Event Triggered Execution; T1554 Compromise Host Software Binary

Exfiltration

T1567 Exfiltration Over Web Service

Resource Development

T1587 Develop Capabilities

Affected products and versions in Miasma — @redhat-cloud-services npm Supply Chain Compromise

  • Red Hat — @redhat-cloud-services npm namespace
    Vulnerable versions: compliance-client 4.0.3; rbac-client 9.0.3; insights-client 4.0.4; frontend-components 7.7.2; frontend-components-utilities 7.4.1; remediations-client 4.0.4; frontend-components-notifications 6.9.2; patch-client 4.0.4; host-inventory-client 5.0.3; rule-components 4.7.2
    Fixed in: Trojanized versions revoked from the npm registry; reinstall the last clean version predating 2026-06-01 and verify integrity via lockfile hashes.

Remediation for Miasma — @redhat-cloud-services npm Supply Chain Compromise

Patches

  • No software patch applies — root cause is a compromised maintainer account and CI pipeline, not a code vulnerability. Remediation is credential rotation and removal of trojanized package versions.

Immediate actions

  • Inventory all installations of @redhat-cloud-services packages; pin/roll back to known-good versions predating 2026-06-01 and purge any of the 32 trojanized releases from lockfiles and caches.
  • Treat all secrets exposed to affected developer workstations and CI/CD runners as compromised: rotate GitHub tokens (GITHUB_TOKEN/PATs), npm and PyPI tokens, SSH keys, Docker/GPG credentials, and .env secrets immediately.
  • Rotate and audit cloud credentials reachable from infected hosts — AWS access keys/IAM roles, GCP application-default and service-account keys, Azure service principals and managed identities — and review CloudTrail/Cloud Audit Logs/Azure Activity for anomalous identity enumeration.
  • Block egress to filev2.getsession.org and Session-network endpoints; alert on the GCP user-agent 'google-api-nodejs-client/7.0.0 gl-node/20.11.0 gccl/7.0.0' from build infrastructure.

Workarounds

  • Configure npm/yarn/pnpm to ignore install scripts globally until the namespace is confirmed clean.
  • Mirror dependencies through an internal proxy registry that quarantines new releases for review before promotion.

Longer-term hardening

  • Disable npm lifecycle scripts in CI by default (npm install --ignore-scripts) and use an allowlisted install policy.
  • Deploy EDR/CI runtime monitoring that flags install-time process spawns, /proc/*/mem reads, and IMDS access from package installers.
  • Enforce dependency allowlisting, SBOM generation, and reproducible-build verification independent of SLSA provenance, since provenance was forged.
  • Adopt short-lived, narrowly-scoped OIDC trust policies and restrict id-token:write to specific protected workflows and branches.

Weaknesses (CWE) in Miasma — @redhat-cloud-services npm Supply Chain Compromise

CWE-506, CWE-1357, CWE-829, CWE-522, CWE-285

Timeline of Miasma — @redhat-cloud-services npm Supply Chain Compromise

  • Original Shai-Hulud self-replicating npm worm first observed, stealing npm/GitHub/CI secrets via lifecycle scripts and re-publishing infected packages.
  • Shai-Hulud 2.0 ('The Second Coming') escalates: preinstall-phase execution and 25,000+ malicious repos across ~500 GitHub users; Microsoft and Wiz publish defender guidance.
  • TeamPCP launches Mini Shai-Hulud, compromising TanStack, Mistral AI, OpenSearch, Guardrails AI and UiPath via hijacked GitHub Actions OIDC tokens and forged SLSA provenance (related chain CVE-2026-45321, CVSS 9.6).
  • TeamPCP publicly releases Mini Shai-Hulud source code, enabling copycats and lowering attribution confidence for subsequent variants.
  • ~14:00 UTC: Root-cause analysis published; GitHub Actions OIDC/SLSA abuse and new GCP/Azure cloud-identity collectors confirmed, with 2 malicious versions still live at time of reporting.
  • ~13:00 UTC: Wiz Research identifies the 'Miasma'/'spartan' variant; most malicious versions begin being revoked from npm.
  • 32 trojanized @redhat-cloud-services package releases (~80,000 weekly downloads) are published via a GitHub Actions OIDC workflow carrying valid SLSA provenance attestations.
  • A Red Hat employee GitHub account is compromised and used to push malicious orphan commits to RedHatInsights repositories on 'oidc-<hex>' branches, bypassing code review.

Sources cited for Miasma — @redhat-cloud-services npm Supply Chain Compromise

Threats related to Miasma — @redhat-cloud-services npm Supply Chain Compromise

Detection coverage for TL-2026-0643

As of 2026-06-01, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0643 across Splunk SPL, Microsoft KQL and Sigma, covering 27 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats