# Miasma — @redhat-cloud-services npm Supply Chain Compromise (Mini Shai-Hulud Variant, GitHub Actions OIDC/SLSA Abuse with GCP/Azure Cloud-Identity Theft)

> On 1 June 2026 Wiz Research identified a supply chain compromise of the @redhat-cloud-services npm namespace in which at least 32 package releases (~80,000 cumulative weekly downloads) were trojanized with a 'Miasma'/'spartan' variant of TeamPCP's open-sourced Mini Shai-Hulud worm. A compromised Red Hat employee GitHub account pushed malicious orphan commits to RedHatInsights repositories, and a minimal GitHub Actions workflow abused a GitHub OIDC id-token to publish the poisoned packages with valid SLSA provenance attestations. The payload runs at install time via a preinstall script, harvests CI/CD and cloud credentials, and adds new GCP and Azure cloud-identity collectors that enumerate every identity reachable from the infected machine.

- **Published:** 2026-06-01T00:00:00Z
- **Last reviewed:** 2026-06-01T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0643
- **ID:** TL-2026-0643
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 27 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-45321

## Description

Miasma is the first observed variant of TeamPCP's 'Mini Shai-Hulud' self-propagating npm worm to target the @redhat-cloud-services namespace, discovered by Wiz Research at approximately 13:00 UTC on 1 June 2026. The variant is largely a cosmetic reskin of Mini Shai-Hulud: the Dune-universe references that characterized the original Shai-Hulud lineage are replaced with Greek-mythology themes (e.g. 'spartan'), and the attacker repository carries the description 'Miasma: The Spreading Blight'. Underlying functionality and tradecraft remain substantially identical to the campaign that compromised TanStack, Mistral AI, OpenSearch, Guardrails AI and UiPath in May 2026 (related chain tracked as CVE-2026-45321, CVSS 9.6).

ROOT CAUSE / DELIVERY: Rather than a stolen npm token, the operators compromised a Red Hat employee GitHub account and used it to push malicious orphan commits to at least three RedHatInsights repositories (frontend-components, javascript-clients, platform-frontend-ai-toolkit) on attacker-created branches following an 'oidc-<8 hex>' naming pattern, bypassing code review. A minimal injected GitHub Actions workflow triggered on push to any branch, requested a GitHub OIDC identity token via 'id-token: write', and executed an obfuscated '_index.js' that exchanged the OIDC token directly with npm for publish credentials. Because publication occurred through legitimate CI infrastructure, the malicious releases carry valid SLSA Build Level 3 provenance attestations generated through the Sigstore stack (Fulcio signing certificate + Rekor transparency log, in-toto statements with the standard GitHub Actions build type) — defeating provenance-based trust signals.

INSTALL-TIME EXECUTION: Each poisoned package ships a 'preinstall': 'node index.js' lifecycle hook, so the payload executes automatically whenever a developer or CI runner installs the dependency. index.js is an unusually large (~4.2 MB) heavily obfuscated JavaScript file using eval() and ROT-based string decoding to conceal functionality, consistent with the obfuscator.io string-table + secondary-cipher layering documented across the Mini Shai-Hulud family.

CREDENTIAL & CLOUD-IDENTITY HARVESTING: The payload sweeps CI/CD secrets (GitHub Actions GITHUB_TOKEN, ACTIONS_RUNTIME_TOKEN, and — in the family — runner-process memory scraped from /proc/{pid}/mem for {"value":...,"isSecret":true} structures), npm/PyPI tokens, SSH keys, Docker and GPG credentials, .env files, and Kubernetes kubeconfigs. The defining evolution in Miasma is the addition of dedicated GCP and Azure cloud-identity collectors that enumerate every identity the infected host can reach: GCP application-default credentials and service-account key files (network calls bear the user-agent 'google-api-nodejs-client/7.0.0 gl-node/20.11.0 gccl/7.0.0'), Azure service-principal credentials and managed-identity tokens, alongside the family's existing AWS access-key/session-token theft via the IMDSv2 flow (169.254.169.254), ECS/Fargate task-metadata endpoint (169.254.170.2), and local HashiCorp Vault agent (127.0.0.1:8200). This marks a strategic shift from pure secret extraction toward leveraging cloud access itself.

PROPAGATION & C2: As a worm, the implant searches stolen npm tokens for ones with 2FA-bypass publish rights, enumerates other packages owned by the compromised maintainer, and re-publishes trojanized tarballs — extending spread beyond the initial namespace. Family C2 routes harvested data through the Session decentralized messaging network (filev2.getsession.org, RSA-4096-OAEP-wrapped AES-256-GCM) and a GitHub dead-drop using the GraphQL createCommitOnBranch mutation with Dependabot-mimicking branch names and 'chore: update dependencies' messages. Some family builds plant a destructive ransom tripwire: newly minted npm tokens are described 'IfYouRevokeThisTokenItWillWipeTheComputerOfTheOwner'.

ATTRIBUTION: Tradecraft overlaps strongly with TeamPCP's Mini Shai-Hulud campaign, but attribution is LOW confidence — TeamPCP publicly released the Mini Shai-Hulud source code, so a copycat reusing public tooling cannot be ruled out.

IMPACT: ~80,000 weekly downloads across 32 releases of a Red Hat-branded namespace widely consumed in console.redhat.com frontends and downstream cloud tooling. Any workstation or CI pipeline that installed an affected version between publication and revocation should treat all CI secrets, cloud credentials (AWS/GCP/Azure), SSH keys, and npm/PyPI tokens as compromised. As of the 14:00 UTC update most malicious versions were revoked, with 2 still live at time of reporting.

## MITRE ATT&CK

- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1199 Trusted Relationship
- T1587 Develop Capabilities
- T1059 Command and Scripting Interpreter
- T1554 Compromise Host Software Binary
- T1546 Event Triggered Execution
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1684.001 Impersonation
- T1036 Masquerading
- T1552 Unsecured Credentials
- T1528 Steal Application Access Token
- T1003 OS Credential Dumping
- T1580 Cloud Infrastructure Discovery
- T1087 Account Discovery
- T1526 Cloud Service Discovery
- T1005 Data from Local System
- T1102 Web Service
- T1573 Encrypted Channel
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction

## Sources

- [Miasma: Supply Chain Attack Targeting RedHat npm Packages](https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages)
- [Red Hat npm Packages Compromised to Spread a Credential-Stealing Worm](https://www.aikido.dev/blog/red-hat-npm-packages-compromised-credential-stealing-worm)
- [Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Hits the npm Ecosystem](https://www.stepsecurity.io/blog/mini-shai-hulud-is-back-a-self-spreading-supply-chain-attack-hits-the-npm-ecosystem)
- [Mini Shai-Hulud: The Worm Returns and Goes Public](https://www.akamai.com/blog/security-research/mini-shai-hulud-worm-returns-goes-public)
- [Mini Shai-Hulud Supply Chain Attack CVE-2026-45321 FAQ](https://www.tenable.com/blog/mini-shai-hulud-frequently-asked-questions)
- [TanStack npm Packages Hit by Mini Shai-Hulud](https://snyk.io/blog/tanstack-npm-packages-compromised/)
- [Mini Shai-Hulud Worm Compromises TanStack, Mistral AI, Guardrails AI & More Packages](https://thehackernews.com/2026/05/mini-shai-hulud-worm-compromises.html)
- [Shai-Hulud: Here We Go Again - Worm by TeamPCP Hits NPM and PyPI](https://research.jfrog.com/post/shai-hulud-here-we-go-again/)
- [Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack](https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/)
- [TanStack npm Packages Compromised in Ongoing Mini Shai-Hulud Supply Chain Attack](https://socket.dev/blog/tanstack-npm-packages-compromised-mini-shai-hulud-supply-chain-attack)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0643