Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub (Shai-Hulud / Mini Shai-Hulud Variant)
Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub (TL-2026-0736), also tracked as Miasma, is a critical-severity supply-chain compromise, first published 2026-06-09. It is attributed to TeamPCP with low confidence, affects Red Hat @redhat-cloud-services npm packages, maps to 29 MITRE ATT&CK techniques (T1003, T1021, T1027), and is covered by 9 detection rules and 35 indicators of compromise.
Key facts for TL-2026-0736
- Threat ID
- TL-2026-0736
- Also known as
- Miasma, Miasma: The Spreading Blight, Miasma-Open-Source-Release
- Severity
- CRITICAL
- Status
- ACTIVE
- Category
- SUPPLY_CHAIN
- First published
- 2026-06-09
- Last reviewed
- 2026-06-09
- Attribution
- TeamPCP
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software development, open-source ecosystems, cloud services, bioinformatics, healthcare research, financial
- Target regions
- North America, Europe, Global
- Detection rules
- 9
- Indicators of compromise
- 35
Malware and tooling in Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub
Malware and tooling: Miasma, bun-v1.3.13
Miasma is a full-spectrum, open-sourced supply chain attack toolkit publicly released on GitHub on June 8, 2026 via four previously compromised developer accounts. Derived from TeamPCP's Mini Shai-Hulud worm, it weaponizes stolen credentials to trojanize packages across npm, PyPI, RubyGems, JFrog Artifactory, GitHub repositories and GitHub Actions, poisons AI coding-tool configurations, and self-propagates using three independent GitHub commit-search C2 channels with AES-256-CBC credential exfiltration.
How Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub works
Miasma is a TypeScript/Bun supply chain attack platform that an operator runs to compromise open-source package ecosystems at scale using stolen credentials. SafeDep, Socket, and Wiz Research independently analyzed the toolkit after a wave of malicious package publications, most notably the trojanizing of @redhat-cloud-services npm packages (~80,000 weekly downloads) traced to a compromised Red Hat employee GitHub account acting as patient zero. Socket's campaign tracker recorded 471 affected artifacts: 411 npm artifacts across 106 packages and 60 PyPI artifacts across 37 packages.
The malware operates entirely within GitHub's infrastructure, using three independent unauthenticated GitHub public commit-search channels as command-and-control: 'DontRevokeOrItGoesBoom' discovers attacker-controlled Personal Access Tokens (PATs) for credential exfiltration (tokens encrypted with AES-256-CBC and an embedded AES key, then enveloped under an RSA-4096 public key), 'TheBeautifulSandsOfTime' delivers base64-encoded JavaScript executed in-memory via eval() for immediate command execution, and 'firedalazer' delivers Python script URLs for a persistent monitor with RSA-PSS signature verification. Each channel uses independent validation/decryption keys to prevent cascading compromise, and a backup channel ('thebeautifulmarchoftime') is present but unwired in the analyzed build.
The attack chain begins at install time. Trojanized npm packages execute via preinstall scripts that invoke a malicious index.js, or via a binding.gyp 'sources' trick ('node index.js > /dev/null 2>&1 && echo stub.c') introduced in the June 4 wave to bypass npm's ignore-scripts protections. A self-extracting payload uses a three-layer scheme (ROT-N outer shell, AES-128-GCM Bun-guard section, AES-128-GCM payload section) and pins Bun v1.3.13. PyPI delivery uses three branches: malicious .pth startup hooks with bundled payloads, trojanized .abi3.so native extensions, and .pth loaders that search sys.path for an external _index.js. Typosquatting uses '-mcp' and '-mpc' suffixes targeting MCP/AI and bioinformatics developers.
Post-exploitation, Miasma harvests GitHub Actions secrets, npm tokens, SSH and Git credentials, and cloud identities (AWS SSM/Secrets Manager, plus new GCP and Azure collectors), Kubernetes, HashiCorp Vault, and password-manager material (1Password, Bitwarden). On GitHub Actions runners it dumps /proc memory for secrets not exposed as env vars and abuses ACTIONS_ID_TOKEN_REQUEST_URL to mint OIDC tokens, then publishes trojanized packages with valid Sigstore/SLSA provenance attestations via branch-mutator and deployment-environment bypass tricks. It performs AWS SSM lateral movement across 17 regions in parallel and SSH-based propagation. Each infection generates a uniquely encrypted payload, rendering hash-based IOCs useful only per package version. The malware checks for EDR (CrowdStrike Falcon, SentinelOne, Microsoft Defender, Carbon Black, Cylance, Trend Micro, Trellix, osquery, Tanium, Qualys), targets StepSecurity Harden-Runner, avoids execution on Russian-language systems, and ships a dead-man switch that wipes the victim home directory (rm -rf ~/) if the stolen PAT is revoked. AI tool poisoning targets Claude Code, Gemini CLI, Cursor, GitHub Copilot, VSCode and others via SessionStart hooks, folderOpen tasks, and rule injection. Attribution is consistent with TeamPCP (tracked as TGR-CRI-1135 / UNC6780 / Replicating Marauder), but because TeamPCP open-sourced the tooling, a copycat actor cannot be ruled out.
MITRE ATT&CK techniques used in TL-2026-0736
Credential Access
T1003 OS Credential Dumping; T1528 Steal Application Access Token; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Lateral Movement
Defense Evasion
T1027 Obfuscated Files or Information; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion
Persistence
T1053 Scheduled Task/Job; T1543 Create or Modify System Process; T1546 Event Triggered Execution
Execution
T1059 Command and Scripting Interpreter
Initial Access
T1078 Valid Accounts; T1195 Supply Chain Compromise
Command and Control
T1102 Web Service; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
Impact
Discovery
T1518 Software Discovery; T1526 Cloud Service Discovery; T1614 System Location Discovery
Collection
defense-impairment
T1553 Subvert Trust Controls; T1685 Disable or Modify Tools
Exfiltration
T1567 Exfiltration Over Web Service
Resource Development
T1586 Compromise Accounts; T1587 Develop Capabilities; T1608 Stage Capabilities
Privilege Escalation
Affected products and versions in Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub
- Red Hat — @redhat-cloud-services npm packages
Vulnerable versions: topological-inventory-client 3.0.10/3.0.11/3.0.13; compliance-client 4.0.3/4.0.4/4.0.6; rbac-client 9.0.3/9.0.4/9.0.6; insights-client 4.0.4/4.0.5/4.0.7; frontend-components 7.7.2/7.7.3/7.7.5; chrome 2.3.1; vulnerabilities-client 2.1.8
Fixed in: versions republished/yanked by npm after June 1, 2026 - npm Registry — npm packages (411 artifacts / 106 packages)
Vulnerable versions: various stolen-credential and OIDC-published versions
Fixed in: yanked by npm - PyPI — PyPI packages (60 artifacts / 37 packages)
Vulnerable versions: langchain-core-mcp 1.4.2/1.4.3; openai-mcp 2.41.1/2.41.2; tiktoken-mcp 0.13.1/0.13.2; instructor-mcp 1.15.2/1.15.3; embiggen 0.11.97; ensmallen 0.8.101; gpsea 0.9.14; pyphetools 0.9.120
Fixed in: yanked by PyPI - GitHub — RedHatInsights repositories and GitHub Actions
Vulnerable versions: frontend-components; javascript-clients; platform-frontend-ai-toolkit (orphan-commit injection)
Fixed in: malicious branches/commits removed
Remediation for Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub
Patches
- No CVE/vendor patch; apply registry-side package yanks (npm/PyPI removed affected versions)
Immediate actions
- Audit and pin all npm/PyPI/RubyGems dependencies to known-good versions; quarantine any @redhat-cloud-services package versions published June 1-9, 2026 and the listed PyPI artifacts
- Rotate all GitHub Personal Access Tokens, npm tokens, SSH keys, and cloud credentials (AWS/GCP/Azure) exposed to CI or developer machines that installed affected packages
- Block and alert on install-time (preinstall/binding.gyp) script execution; enable npm --ignore-scripts in CI
- Hunt for the listed C2 commit-search strings, file paths, and commit-message patterns across repos and endpoints
Workarounds
- Use lockfile + integrity hashes and an internal package proxy/allowlist
- Disable AI coding-tool auto-run hooks (SessionStart, folderOpen tasks) from untrusted repos
Longer-term hardening
- Deploy EDR with behavioral detection for eval()-based in-memory execution and credential-access patterns
- Adopt StepSecurity Harden-Runner or equivalent egress filtering on GitHub Actions runners
- Enforce phishing-resistant MFA and short-lived tokens; restrict OIDC id-token:write to vetted workflows
- Implement provenance verification that validates publisher identity, not just attestation presence
Weaknesses (CWE) in Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub
CWE-506, CWE-829, CWE-494, CWE-1357, CWE-522, CWE-78
Timeline of Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub
- Earliest credential evidence linked to the campaign found in infostealer logs (discovered by Whiteintel).
- Second infostealer-log credential evidence date associated with the operation.
- First 'Miasma: The Spreading Blight' commit observed, marking the malware family's emergence as a Mini Shai-Hulud evolution.
- @redhat-cloud-services npm packages trojanized via a compromised Red Hat employee account using orphan-commit OIDC workflows; most malicious versions revoked by ~1PM UTC, two remained.
- New wave abuses binding.gyp 'sources' field for malicious code execution, bypassing npm ignore-scripts protections.
- Miasma full attack toolkit open-sourced on GitHub via four previously compromised developer accounts (repo pattern 'Miasma-Open-Source-Release').
- GitHub removed 70+ Microsoft repositories and yanked source repos; npm and PyPI removed affected package versions.
- SafeDep, Socket, Wiz Research, The Hacker News, SecurityWeek and The Register publish analyses; Socket tracker records 471 affected artifacts (411 npm/106 packages, 60 PyPI/37 packages).
Sources cited for Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub
- Miasma supply-chain attack toolkit goes public on GitHub
- Inside the Miasma Supply Chain Attack Toolkit
- Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious Packages
- Miasma: Supply Chain Attack Targeting RedHat npm Packages
- Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
- Miasma NPM Supply Chain Attack: Red Hat Cloud Services npm Packages Backdoored in Latest Shai-Hulud Variant
- Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks
- Mass npm Supply Chain Attack: TanStack and Mistral AI Packages
Threats related to Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub
- Shai-Hulud 'Hades' Campaign — Trojanized PyPI Packages Auto-Execute Bun Credential Stealer via Python Wheel Startup Hooks (*-setup.pth)
- Miasma — @redhat-cloud-services npm Supply Chain Compromise (Mini Shai-Hulud Variant, GitHub Actions OIDC/SLSA Abuse with GCP/Azure Cloud-Identity Theft)
- Miasma Worm Compromises 73 Microsoft GitHub Repositories Across Azure, Azure-Samples, Microsoft & MicrosoftDocs — Self-Replicating Mini Shai-Hulud Variant Weaponizing AI Coding Agents (TeamPCP)
- Popular npm Packages in the keyv and Cacheable Namespaces Compromised in Active Supply Chain Attack
- Binding.gyp "Phantom Gyp" Supply Chain Attack (Miasma Worm) Enables CI/CD Worm Propagation Across 57 npm Packages
- lightning PyPI Package Compromise — Versions 2.6.2 & 2.6.3 Execute Bun-Based JavaScript Credential Stealer on Import (Shai-Hulud-Overlapping)
Detection coverage for TL-2026-0736
As of 2026-06-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0736 across Splunk SPL, Microsoft KQL and Sigma, covering 35 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.