Miasma: Supply Chain Attack Targeting RedHat npm Packages

On 1 June 2026 Wiz Research reported a supply‑chain compromise affecting packages under the @redhat-cloud-services npm namespace: at least 32 malicious package releases (≈80k weekly downloads) included obfuscated, installation‑time payloads ("Miasma") derived from Mini Shai‑Hulud that collect cloud identities (GCP/Azure) and secrets. The root cause appears to be a compromised Red Hat employee GitHub account that pushed orphan commits and malicious GitHub Actions requesting OIDC tokens to publish packages with valid SLSA attestations. Organizations are advised to investigate developer workstations, CI/CD systems, rotate exposed credentials, audit affected packages/workflows, and apply supply‑chain protections such as allowlisting, SBOMs, and package verification.