Executive Summary
On June 1, 2026, a supply chain attack targeted multiple npm packages within the @redhat-cloud-services scope. The threat actor, identified as Miasma, published malicious versions containing a 4.1 MB obfuscated JavaScript file triggered via a preinstall hook. This multi-stage attack chain bypasses traditional Node.js analysis by downloading and executing a legitimate Bun runtime to run the final credential-stealing payload.
The attack is highly sophisticated, utilizing a Caesar wrapper followed by an AES-128-GCM encrypted payload. The final stage targets a wide array of cloud and CI/CD credentials, including AWS, Azure, GCP, HashiCorp Vault, Kubernetes, and GitHub Actions OIDC tokens. Notably, the campaign lacks a traditional C2 domain, instead abusing legitimate GitHub and npm registry endpoints for data exfiltration and further propagation.
This campaign poses a critical risk to developers and DevOps environments. By leveraging npm's Trusted Publishing and GitHub's GraphQL API, the malware can spread by injecting malicious workflows into repositories and re-publishing compromised packages, potentially leading to widespread organizational compromise and long-term persistence.