MIASMA RED HAT NPM SUPPLY CHAIN COMPROMISE CAMPAIGN

MiasmaRed Hat@redhat-cloud-servicesnpmsupply chain attackShai-HuludMini Shai-Huludcredential stealerGitHub Actions OIDCnpm lifecycle scriptpreinstall hookCI/CD compromisedeveloper credentialscloud secrets

Miasma is a Mini Shai-Hulud-derived npm supply-chain campaign that compromised official @redhat-cloud-services packages and executed a credential-stealing worm during package installation. Public reporting confirms 96 compromised versions across 32 packages, with developer credentials, cloud secrets, SSH keys, CI/CD tokens, and npm tokens treated as exposed if affected versions were installed.

Indicators of Compromise

Hashes (7)

ac2a2208e1726e008be6c73dc0872d9bba163319259dff1b62055ac933ca46b6ee262510cb246d2b904991aee7fc61162bdae34463439ec6383bd5356479d36221b6409a7b84446310daca5409ad6112ac60a1e4bef97736e53fff5f63bfdef4d07ec47042a05fe3d684f72d2155d18088896d478986d453f5da79b311de39d9b4b1bea95c21af1d8ef181b0f4e52fe90dc06ecdaa63fe24859cfd955053c23245c536e4733480239d14bebf12688e352bec18af5f0f9cbe8949cc2bf5466dc6

Notes

<div>NOTES / CONCLUSIONMiasma used legitimate Red Hat npm package names as trusted delivery vehicles, so package reputation alone is not a sufficient control. Environments that installed affected versions should treat developer, CI/CD, cloud, SSH, GitHub, and npm credentials as exposed, remove compromised package versions, rebuild lockfiles from trusted metadata, and rotate secrets immediately.Red Hat stated that the affected packages were removed and that the malicious code was not published for customer consumption through console.redhat.com; public reporting did not confirm customer, partner, or production system impact. SOCRadar IOC Radar, Cyber Threat Intelligence, Attack Surface Management, and Dark Web Monitoring can support dependency exposure review, indicator monitoring, and follow-on access-risk monitoring.<div> </div></div>

Mitigation

MITIGATION<div style="margin-left:0pt;" align="center"><table style="border:none;border-collapse:collapse;"><colgroup><col><col><col><col></colgroup><tbody><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Tactic</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Technique</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">ID</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Reference</td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Initial Access</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Compromise Software Dependencies and Development Tools</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1195/001/">T1195.001</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1195/001/">T1195.001 ↗</a></td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Execution</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Command and Scripting Interpreter: JavaScript</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/007/">T1059.007</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1059/007/">T1059.007 ↗</a></td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Credential Access</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Unsecured Credentials: Credentials In Files</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1552/001/">T1552.001</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1552/001/">T1552.001 ↗</a></td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Discovery</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">File and Directory Discovery</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1083/">T1083</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1083/">T1083 ↗</a></td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Defense Evasion</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Obfuscated Files or Information</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1027/">T1027</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1027/">T1027 ↗</a></td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Command and Control</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Ingress Tool Transfer</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1105/">T1105</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1105/">T1105 ↗</a></td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Exfiltration</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Exfiltration Over C2 Channel</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1041/">T1041</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1041/">T1041 ↗</a></td></tr><tr style="height:0pt;"><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Defense Evasion</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;">Valid Accounts</td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1078/">T1078</a></td><td style="border-left:solid #bfbfbf 0.5pt;border-right:solid #bfbfbf 0.5pt;border-bottom:solid #bfbfbf 0.5pt;border-top:solid #bfbfbf 0.5pt;vertical-align:top;background-color:#efefef;padding:0pt 5.4pt 0pt 5.15pt;overflow:hidden;overflow-wrap:break-word;"><a href="https://attack.mitre.org/techniques/T1078/">T1078 ↗</a></td></tr></tbody></table></div>