Miasma Attack Hits Red Hat npm Packages

Malicious code (campaign "Miasma") was embedded in at least 32 releases under the @redhat-cloud-services npm namespace on June 1, 2026; the compromised packages include preinstall scripts that run an obfuscated payload which steals developer and cloud credentials, enumerates cloud identities (including new GCP/Azure collectors), and self-propagates by republishing packages the compromised identity can publish. The publisher workflow was created via a compromised Red Hat employee GitHub account that requested OIDC tokens and produced legitimately-signed SLSA provenance, widening impact across developer workstations and CI runners; recommended immediate actions are to stop installing affected versions, reinstall with scripts disabled, rotate all reachable credentials, remove persistence, and harden GitHub/CI trust boundaries.