Critical Red Hat Cloud Services NPM Flaw Lets Attackers Steal Credentials

Key Takeaways

• Over 30 official Red Hat Cloud Services npm packages were compromised in a supply chain attack.
• The attack deployed “Miasma: The Spreading Blight,” a credential-stealing worm, by hijacking the CI/CD pipeline.
• The malware targets a wide array of sensitive credentials, including GitHub, cloud, and developer tool tokens.
• Attackers used sophisticated evasion techniques, including obfuscated payloads and disguised exfiltration traffic.
• Organizations must immediately identify and isolate compromised systems, carefully remove persistence, and then rotate all affected credentials.

Widespread Credential Theft Targets Red Hat Cloud Services NPM Ecosystem

On June 1, 2026, a sophisticated supply chain attack infiltrated over 30 official npm packages under the @redhat-cloud-services scope, injecting credential-stealing malware into widely-used components. This campaign, dubbed “Miasma: The Spreading Blight,” represents a new iteration of the Mini Shai-Hulud malware family, previously associated with the threat actor group TeamPCP.

Unlike typical typosquatting schemes, this incident involved attackers directly compromising a legitimate and trusted npm namespace. They published malicious versions of crucial frontend components, API clients, and developer tooling, leveraging the inherent trust in the Red Hat ecosystem.

According to research from Aikido and JFrog, the malicious packages were distributed through compromised GitHub Actions OIDC tokens. This critical detail indicates that the attackers breached the continuous integration/continuous delivery (CI/CD) pipeline itself, rather than individual developer accounts, highlighting a significant supply chain vulnerability.

Technical Deep Dive: How “Miasma” Operates

Each compromised package contained a malicious preinstall lifecycle hook within its package.json file, configured to execute node index.js. This script automatically triggered a 4.2 MB obfuscated payload during every npm install command, even before any application code could run.

The malware employed a multi-stage decryption process to evade detection, utilizing numeric character arrays, a ROT-style transformation, and AES-128-GCM blobs. After decryption, it deployed a transient Bun-based payload to /tmp/p*.js for execution, ensuring minimal forensic footprint.

Once active, “Miasma” initiated a comprehensive credential harvesting operation, targeting a broad spectrum of sensitive information:

• GitHub tokens: Including classic, fine-grained, and GitHub Actions OIDC tokens.
• Cloud credentials: AWS access keys, GCP service account files, and Azure service principal/managed identity tokens.
• Infrastructure secrets: Kubernetes service account tokens, kubeconfig files, and HashiCorp Vault tokens.
• Developer tooling: npm and PyPI publish tokens, SSH private keys, Docker registry credentials, GPG keys, and .env files across the filesystem.

In cloud environments, the malware extended its reach beyond static files, actively querying services like AWS Secrets Manager, SSM Parameter Store, Azure Key Vault, and GCP Secret Manager whenever permissions allowed. GitHub Actions runners were particularly vulnerable, with the payload designed to read secrets directly from runtime process memory, effectively bypassing workflow log masking mechanisms.

Evasion and Persistence Mechanisms

A notable evasion tactic involved disguising exfiltration traffic to api.anthropic.com/v1/api. This domain, while legitimate for Anthropic services, used an invalid path (/v1/api), allowing the attackers to blend malicious network activity with legitimate traffic in organizations utilizing Anthropic AI tools. Defenders are advised to specifically hunt for node or Bun processes communicating with this host from CI runners or developer machines.

The malware also utilized a GitHub dead-drop model, creating public repositories under compromised victim accounts with the description “Miasma: The Spreading Blight” and committing stolen credentials as JSON result files.

For persistence, “Miasma” installed monitoring services, specifically kitty-monitor.service on Linux and com.user.kitty-monitor.plist on macOS, which periodically polled for remote instructions. It also injected hooks into popular AI developer tools such as Claude, Codex, Gemini, Copilot, Kiro, and opencode, and added VS Code folder-open tasks to re-execute the payload upon project opening.

A particularly critical and destructive component is the gh-token-monitor. This token monitor actively watches stolen GitHub tokens. If a token is revoked before the malware’s persistence mechanisms are fully removed, it can trigger destructive commands, including wiping the user’s home directory. This “dead-man switch” functionality underscores the importance of careful incident response: machines must be isolated and persistence thoroughly eradicated before any tokens are revoked.

Indicators of Compromise

Any project that installed the following package versions on or after June 1, 2026, should be considered compromised. The complete list of 31 affected @redhat-cloud-services npm packages and their malicious versions is provided below:

If any of these package versions were installed in your environment on or after June 1, 2026, all GitHub tokens, npm tokens, cloud credentials (AWS, GCP, Azure), Kubernetes service account tokens, SSH keys, and CI/CD secrets should be treated as compromised. Immediate isolation of affected machines is crucial before attempting to revoke any tokens to prevent triggering the malware’s destructive “dead-man switch.”

What You Should Do

• Immediately run npm uninstall for all identified malicious packages and regenerate lockfiles from trusted metadata.
• As a temporary security measure, configure CI pipelines to use npm ci --ignore-scripts to prevent automatic execution of preinstall hooks.
• Before revoking any credentials, ensure that persistence files for kitty-monitor and gh-token-monitor are removed from all affected machines.
• Inspect configuration files such as .claude/settings.json, .vscode/tasks.json, and ~/.config/index.js for any injected malicious hooks.
• Audit npm and GitHub accounts for unusual patch-version publications or new repositories with the description “Miasma: The Spreading Blight.”
• Only after confirming the complete removal of malware persistence, rotate all exposed credentials, including GitHub tokens, npm tokens, cloud keys, SSH keys, Vault tokens, and Kubernetes service account tokens.
• Rebuild any compromised CI runners and developer workstations from clean, trusted images.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.