Red Hat npm Packages Compromised in Widespread Credential-Stealing Campaign

A significant npm supply chain attack, identified by Microsoft Threat Intelligence as 'Miasma: The Spreading Blight,' has led to the compromise of more than 90 versions across 32 maliciously modified packages under the `@redhat-cloud-services` npm scope. The attack originated from a breach within the upstream RedHatInsights/javascript-clients Continuous Integration and Continuous Delivery (CI/CD) pipeline. Attackers exploited the legitimate GitHub Actions OpenID Connect (OIDC) publishing workflow to distribute trojanized packages, which deceptively carried authentic provenance signatures. This allowed the malicious code to spread effectively, embedding itself into developer systems and CI/CD environments. The malware's primary objective was credential theft, targeting a wide array of sensitive data. Upon execution, the malicious payload downloaded the Bun runtime and detonated its final stage. It exhibited environment gating, validating the execution environment and optionally restricting itself to CI/CD systems. The malware was designed for defense evasion and aggressively harvested secrets and authentication tokens. This included GitHub credentials, npm and major cloud provider keys, HashiCorp Vault tokens, and Kubernetes environment credentials. On developer systems, it stole SSH keys, command-line interface (CLI) credentials, and browser/wallet data. Within CI/CD environments, the malware scraped GitHub Actions runner memory for secrets, escalated privileges using passwordless sudo, and republished poisoned packages with forged Supply-chain Levels for Software Artifacts (SLSA) provenance to ensure downstream propagation. Microsoft shared its findings with the npm team, leading to the removal of affected repositories and the implementation of additional protections on the `@redhat-cloud-services` namespace to prevent further unauthorized publishing. Organizations are advised to audit CI/CD logs for unusual network connections or script execution, review npm package lockfiles, and enable cloud-delivered protection in antivirus solutions like Microsoft Defender Antivirus.