MIASMA RED HAT NPM SUPPLY CHAIN COMPROMISE CAMPAIGN

T1195.001 – Compromise Software Dependencies and Development Tools

Initial Access (TA0001)

DET0511

Detect Malicious Package Installation via Supply Chain

AN-MIA-001

Monitor package-lock.json, pnpm-lock.yaml, yarn.lock, CI logs, and package caches for affected @redhat-cloud-services packages and versions. Alert on newly published versions from trusted scopes that introduce lifecycle scripts.

T1059.007 – Command and Scripting Interpreter: JavaScript

Execution (TA0002)

DET0332

Detect Suspicious npm Lifecycle Script Execution

AN-MIA-002

Alert when npm install, npm ci, yarn, or pnpm runs node index.js from a package that should contain only types, clients, or static frontend assets.

T1027 – Obfuscated Files or Information

Defense Evasion (TA0005)

DET0013

Detect Obfuscated Installer and Staged Payload Patterns

AN-MIA-003

Identify large numeric arrays, ROT-style transforms, eval patterns, AES-GCM blob decoding, and temporary payload writes under /tmp/p*.js or similar paths.

T1105 – Ingress Tool Transfer

Command and Control (TA0011)

DET0209

Detect Unauthorized Bun Runtime Staging

AN-MIA-004

Monitor downloads or execution of Bun from npm lifecycle contexts, especially /tmp/b-*/bun, /tmp/b-*/bun.exe, /tmp/b-*/b.zip, and /tmp/.bun_ran.

T1552.001 – Unsecured Credentials: Credentials In Files

Credential Access (TA0006)

DET0412

Detect Credential File Harvesting by Node or Bun Processes

AN-MIA-005

Alert on node, bun, or package-manager child processes reading .npmrc, SSH keys, GitHub tokens, cloud credentials, Kubernetes config, Vault tokens, or CI secret files.

T1083 – File and Directory Discovery

Discovery (TA0007)

DET0107

Detect Broad Developer Workstation and CI File Discovery

AN-MIA-006

Track recursive enumeration of home directories, repository folders, package caches, and CI workspaces immediately after package installation.

T1567.001 – Exfiltration to Code Repository

Exfiltration (TA0010)

DET0310

Detect GitHub Dead-Drop and Disguised Exfiltration Behavior

AN-MIA-007

Inspect outbound requests to GitHub search APIs and unusual API endpoints after npm install. Correlate with repository descriptions or paths containing Miasma: The Spreading Blight and results/results-*.json.

T1078 – Valid Accounts

Initial Access (TA0001)

DET0074

Detect Suspicious CI/CD Identity Use for npm Publishing

AN-MIA-008

Monitor GitHub Actions OIDC publishing events, unusual maintainers, unexpected workflow changes, and package publication activity outside normal release patterns.