# Miasma Supply Chain Attack Toolkit Open-Sourced on GitHub (Shai-Hulud / Mini Shai-Hulud Variant)

> Miasma is a full-spectrum, open-sourced supply chain attack toolkit publicly released on GitHub on June 8, 2026 via four previously compromised developer accounts. Derived from TeamPCP's Mini Shai-Hulud worm, it weaponizes stolen credentials to trojanize packages across npm, PyPI, RubyGems, JFrog Artifactory, GitHub repositories and GitHub Actions, poisons AI coding-tool configurations, and self-propagates using three independent GitHub commit-search C2 channels with AES-256-CBC credential exfiltration.

- **Published:** 2026-06-09T00:00:00Z
- **Last reviewed:** 2026-06-09T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0736
- **ID:** TL-2026-0736
- **Severity:** CRITICAL
- **Category:** SUPPLY_CHAIN
- **Status:** ACTIVE
- **Actor:** TeamPCP
- **Detections:** 9 · **IOCs:** 35 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Miasma is a TypeScript/Bun supply chain attack platform that an operator runs to compromise open-source package ecosystems at scale using stolen credentials. SafeDep, Socket, and Wiz Research independently analyzed the toolkit after a wave of malicious package publications, most notably the trojanizing of @redhat-cloud-services npm packages (~80,000 weekly downloads) traced to a compromised Red Hat employee GitHub account acting as patient zero. Socket's campaign tracker recorded 471 affected artifacts: 411 npm artifacts across 106 packages and 60 PyPI artifacts across 37 packages.

The malware operates entirely within GitHub's infrastructure, using three independent unauthenticated GitHub public commit-search channels as command-and-control: 'DontRevokeOrItGoesBoom' discovers attacker-controlled Personal Access Tokens (PATs) for credential exfiltration (tokens encrypted with AES-256-CBC and an embedded AES key, then enveloped under an RSA-4096 public key), 'TheBeautifulSandsOfTime' delivers base64-encoded JavaScript executed in-memory via eval() for immediate command execution, and 'firedalazer' delivers Python script URLs for a persistent monitor with RSA-PSS signature verification. Each channel uses independent validation/decryption keys to prevent cascading compromise, and a backup channel ('thebeautifulmarchoftime') is present but unwired in the analyzed build.

The attack chain begins at install time. Trojanized npm packages execute via preinstall scripts that invoke a malicious index.js, or via a binding.gyp 'sources' trick ('node index.js > /dev/null 2>&1 && echo stub.c') introduced in the June 4 wave to bypass npm's ignore-scripts protections. A self-extracting payload uses a three-layer scheme (ROT-N outer shell, AES-128-GCM Bun-guard section, AES-128-GCM payload section) and pins Bun v1.3.13. PyPI delivery uses three branches: malicious .pth startup hooks with bundled payloads, trojanized .abi3.so native extensions, and .pth loaders that search sys.path for an external _index.js. Typosquatting uses '-mcp' and '-mpc' suffixes targeting MCP/AI and bioinformatics developers.

Post-exploitation, Miasma harvests GitHub Actions secrets, npm tokens, SSH and Git credentials, and cloud identities (AWS SSM/Secrets Manager, plus new GCP and Azure collectors), Kubernetes, HashiCorp Vault, and password-manager material (1Password, Bitwarden). On GitHub Actions runners it dumps /proc memory for secrets not exposed as env vars and abuses ACTIONS_ID_TOKEN_REQUEST_URL to mint OIDC tokens, then publishes trojanized packages with valid Sigstore/SLSA provenance attestations via branch-mutator and deployment-environment bypass tricks. It performs AWS SSM lateral movement across 17 regions in parallel and SSH-based propagation. Each infection generates a uniquely encrypted payload, rendering hash-based IOCs useful only per package version. The malware checks for EDR (CrowdStrike Falcon, SentinelOne, Microsoft Defender, Carbon Black, Cylance, Trend Micro, Trellix, osquery, Tanium, Qualys), targets StepSecurity Harden-Runner, avoids execution on Russian-language systems, and ships a dead-man switch that wipes the victim home directory (rm -rf ~/) if the stolen PAT is revoked. AI tool poisoning targets Claude Code, Gemini CLI, Cursor, GitHub Copilot, VSCode and others via SessionStart hooks, folderOpen tasks, and rule injection. Attribution is consistent with TeamPCP (tracked as TGR-CRI-1135 / UNC6780 / Replicating Marauder), but because TeamPCP open-sourced the tooling, a copycat actor cannot be ruled out.

## MITRE ATT&CK

- T1586 Compromise Accounts
- T1608 Stage Capabilities
- T1587 Develop Capabilities
- T1195 Supply Chain Compromise
- T1078 Valid Accounts
- T1059 Command and Scripting Interpreter
- T1053 Scheduled Task/Job
- T1543 Create or Modify System Process
- T1546 Event Triggered Execution
- T1611 Escape to Host
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1553 Subvert Trust Controls
- T1552 Unsecured Credentials
- T1555 Credentials from Password Stores
- T1528 Steal Application Access Token
- T1003 OS Credential Dumping
- T1518 Software Discovery
- T1526 Cloud Service Discovery
- T1614 System Location Discovery
- T1021 Remote Services
- T1530 Data from Cloud Storage
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1573 Encrypted Channel
- T1567 Exfiltration Over Web Service
- T1485 Data Destruction

## Sources

- [Miasma supply-chain attack toolkit goes public on GitHub](https://www.theregister.com/cyber-crime/2026/06/09/miasma-supply-chain-attack-toolkit-goes-public-on-github/5253074)
- [Inside the Miasma Supply Chain Attack Toolkit](https://safedep.io/inside-the-miasma-supply-chain-attack-toolkit/)
- [Mini Shai-Hulud, Miasma, and Hades Worms Target Bioinformatics and MCP Developers via Malicious Packages](https://socket.dev/blog/mini-shai-hulud-miasma-and-hades-worms-target-bioinformatics-and-mcp-developers-via-malicious)
- [Miasma: Supply Chain Attack Targeting RedHat npm Packages](https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages)
- [Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm](https://thehackernews.com/2026/06/miasma-supply-chain-attack-compromises.html)
- [Miasma NPM Supply Chain Attack: Red Hat Cloud Services npm Packages Backdoored in Latest Shai-Hulud Variant](https://phoenix.security/miasma-redhat-cloud-services-npm-supply-chain-shai-hulud-variant/)
- [Over 100 NPM, PyPI Packages Hit in New Shai-Hulud Supply Chain Attacks](https://www.securityweek.com/over-100-npm-pypi-packages-hit-in-new-shai-hulud-supply-chain-attacks/)
- [Mass npm Supply Chain Attack: TanStack and Mistral AI Packages](https://safedep.io/mass-npm-supply-chain-attack-tanstack-mistral/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0736