Executive Summary
A series of sophisticated npm supply chain attacks, collectively referred to as the 'Miasma' campaign, has compromised over 88 packages including those from the @redhat-cloud-services, @vapi-ai, and ai-sdk-ollama organizations. The campaign leverages a 6-stage dropper mechanism with heavy obfuscation and encryption, significantly surpassing the complexity of typical npm malware. While the core logic is based on the open-source Shai-Hulud infostealer, analysts suspect a new threat actor (possibly with Chinese linguistic ties) is behind these variants due to the advanced tradecraft observed.
Technically, the malware uses GitHub not just for data hosting but as a functional C2 server, fetching new payloads from commits tagged with the string 'firedalazer'. It features a destructive 'nuke' capability that deletes the victim machine if stolen tokens are revoked. The campaign has affected over 300 GitHub repositories and resulted in approximately 647,000 monthly downloads of malicious package versions. Affected organizations must immediately rotate all cloud, npm, and GitHub credentials.