Miasma Malware Hits 32 Crimson Hat Packages by way of Compromised GitHub Account

On 1 June 2026, consultants from a number of cybersecurity corporations discovered a significant provide chain compromise affecting software program elements utilized by Crimson Hat. Safety corporations Microsoft, Wiz Analysis, Snyk, and Aikido reported that hackers sneaked dangerous code into software program packages beneath the @redhat-cloud-services identify on npm, which is a public library the place builders get constructing blocks for his or her code.

The problem impacted at the least 32 packages, resulting in 96 compromised variations, which assist run the Crimson Hat Hybrid Cloud Console and are downloaded round 80,000 to 117,000 occasions each week. Given the modules’ vast integration, the influence radius extends past Crimson Hat’s infrastructure to exterior growth pipelines.

How the Infrastructure Was Exploited

The hackers didn’t guess passwords or use typosquatted webpages. As a substitute, they obtained into the non-public GitHub account of an actual Crimson Hat employee. They used this account to push hidden code adjustments (malicious orphan commits) instantly into two RedHatInsights repositories with out anybody reviewing the code.

As proven within the picture from Wiz, these adjustments occurred throughout two waves of exercise. The unauthorized commits launched a minimal GitHub Actions workflow that requested short-lived OIDC identification tokens from GitHub.

The system used these tokens to authenticate instantly with npm’s trusted publishing endpoint to add the backdoored packages. As a result of the code got here from a respectable Crimson Hat setup, the compromised variations shipped with legitimate SLSA provenance attestations, making them seem genuine to safety scanners.

The Miasma Malware

Researchers have named this particular malware variant Miasma. It operates as a self-propagating worm and credential stealer based mostly on Mini Shai-Hulud, an open-source malware framework printed on BreachForums by the menace group TeamPCP earlier in 2026. This new model replaces outdated area themes with Greek mythology phrases like Spartan.

When a developer installs one among these damaged packages, a hidden preinstall script triggers robotically earlier than any regular code runs. It instantly hunts for delicate information on the pc. This contains cloud login keys for Google Cloud, Microsoft Azure, and Amazon Net Providers, in addition to SSH keys, password information, and keys for AI instruments like Claude and Gemini.

Moreover, the worm queries the npm registry for different packages the contaminated identification has rights to switch. It then robotically republishes these packages with the identical malicious payload, turning a single compromised workstation right into a vector to contaminate extra registries.

Registry directors revoked many of the malicious variations inside hours of disclosure, however the provide chain investigation continues. Safety groups are suggested to test their lockfiles, block set up scripts utilizing the ignore-scripts configuration, and instantly rotate any cloud credentials or tokens accessible from affected construct environments.

Experiences from all respective corporations can be found right here: Microsoft, Wiz Analysis, Snyk, and Aikido.