Miasma RedHat npm Supply Chain Attack
Provisional: this score is the AI investigator's judgment, not yet calculated by our published formula. Treat it as indicative. How scoring works →
anchored·5ihgTR…oJDTSummary
Miasma is a self-propagating credential-stealing worm that compromised 32 npm packages under the @redhat-cloud-services namespace on June 1, 2026, publishing roughly 95-96 malicious versions to packages with an estimated 80,000 to 116,991 weekly downloads. The attack used a Red Hat employee's compromised GitHub account and GitHub Actions OIDC trusted publishing to push a 4.2 MB obfuscated preinstall payload derived from the Mini Shai-Hulud malware family, which is attributed to the threat actor group TeamPCP but was publicly released, so copycat use cannot be ruled out. The worm harvests cloud, CI/CD and developer credentials. Reports disagree on whether it also targets cryptocurrency wallets: Microsoft reports a list of 166 crypto browser-extension IDs, while an earlier summary found no crypto-specific targeting.
Connected Entities
7 entities · 60 linked investigations- Phantom Wallet→mentioned with→Coinbase(60%)
- Miasma npm Supply Chain Attack (Red Hat)→mentioned with→Coinbase(75%)
- Miasma npm Supply Chain Attack (Red Hat)→mentioned with→Binance(75%)
- Miasma npm Supply Chain Attack (Red Hat)→mentioned with→Phantom Wallet(65%)
- Miasma RedHat npm Supply Chain Attack→mentioned with→Shai-Hulud / TeamPCP Supply Chain Attack(60%)
- Miasma npm Supply Chain Attack (Red Hat)→mentioned with→Shai-Hulud / TeamPCP Supply Chain Attack(70%)
- Miasma RedHat npm Supply Chain Attack→mentioned with→Polymarket(65%)
Connected Through
5 shared actors · 619 investigationsDistinct actors this investigation shares with others — holders, traders, and named parties. Shared infrastructure (exchanges, pools) is excluded.
- □Binanceorganization
- ♦Coinbasetoken
- □Phantom Walletorganization
- □Polymarketorganization
1 submission awaiting moderator review.
Timeline(19 events)
September 2025
The original Shai-Hulud worm emerges as the first self-replicating malware targeting the npm ecosystem; it is attributed to TeamPCP.
Tenable Mini Shai-Hulud FAQApril 2026
A Red Hat employee's GitHub credential and active session cookie appear in infostealer logs, about seven weeks before the attack (identified later by Whiteintel, which could not confirm a direct causal link).
Whiteintel; Cloud Security Alliance Research NoteApril 2026
Bitwarden CLI is compromised through a poisoned GitHub Actions workflow in the Mini Shai-Hulud campaign; the payload targets crypto wallet data.
Aikido SecurityApril 2026
Four SAP npm packages are compromised through a leaked npm token in the Mini Shai-Hulud campaign.
Aikido SecurityApril 2026
The PyTorch Lightning package on PyPI is compromised as part of the same campaign.
Aikido SecurityMay 2026
TeamPCP open-sources the full Mini Shai-Hulud source code on GitHub under an MIT License ('Shai-Hulud: Open Sourcing The Carnage') and announces a $1,000 BreachForums contest for the largest supply chain attack using the code. The campaign expands to 160+ packages the same day.
ReversingLabs; SecurityWeek; TenableMay 2026
The Red Hat employee's GitHub credential appears in infostealer logs a second time, from a different source channel.
Whiteintel; The Hacker NewsMay 2026
Microsoft's DurableTask npm package is compromised in the Mini Shai-Hulud campaign.
Aikido SecurityMay 2026
Nine malicious Polymarket-branded npm packages are published to steal crypto wallet keys.
SafeDepMay 2026
Socket reports the TrapDoor campaign: 34+ malicious packages across npm, PyPI and Crates.io targeting crypto and DeFi developers.
CyberLevelingMay 2026
The earliest malicious commit containing the string 'Miasma: The Spreading Blight' appears in RedHatInsights repositories.
The Hacker NewsJune 2026
First wave of malicious @redhat-cloud-services packages is published at about 10:53 UTC, with valid SLSA provenance attestations.
Wiz Blog; Orca SecurityJune 2026
The Register reports that Socket had identified 95 affected package versions as of 11:00 UTC, with combined weekly downloads of about 80,000.
The RegisterJune 2026
Wiz Research publicly discloses the Miasma campaign at about 13:00 UTC; most malicious versions are revoked from npm.
Snyk; The Register; BleepingComputerJune 2026
Second malicious wave is published between about 13:44 and 13:46 UTC; the root cause is identified.
SnykJune 2026
Red Hat publishes Security Bulletin RHSB-2026-006, stating that no Red Hat products shipped with compromised versions and no customer action is required, and removes the affected versions from npm.
Red Hat Security Bulletin RHSB-2026-006June 2026
More compromised package versions are discovered; the Microsoft Defender Security Research Team publishes its analysis of the incident.
Microsoft Security BlogJune 2026
Red Hat updates RHSB-2026-006 with preliminary findings and describes the investigation as ongoing.
Red Hat Security Bulletin RHSB-2026-006June 2026
The Cloud Security Alliance publishes a research note on Miasma with extended technical analysis.
Cloud Security AllianceDecision Log
- slot 426681726 · hash 67ENERwMvWejE12hHanefbp6qe6cCFenewhZEToqvTA9
This investigation is cryptographically anchored to the Solana blockchain (1 decision). 34 of 34 cited source URLs have an Internet Archive snapshot.
model: claude-code-merge-writer
generated: 6/15/2026, 5:42:54 PM
last updated: 10/2/2026, 5:25:06 AM
4 viewsavoid.net — verified advice for a post-truth world