Miasma Malware Hits 32 Red Hat Packages via Compromised GitHub Account
32 Red Hat npm packages compromised via stolen GitHub account; Miasma malware steals credentials and CI/CD tokens.
On June 1, 2026, researchers discovered that 32 Red Hat npm packages under @redhat-cloud-services were compromised after attackers gained access to a Red Hat employee's GitHub account and injected malicious code. The Miasma malware—a self-propagating worm variant based on the Mini Shai-Hulud framework—steals cloud tokens, SSH keys, and developer credentials; it also self-replicates by targeting other packages the infected developer can access. The attack affected 96 package versions downloaded 80,000–117,000 times weekly and leveraged valid SLSA provenance attestations to evade security scanners.
AI summary of the linked source. Not reviewed by an editor. How this works
Run Red Hat?
Get an email when a new story names Red Hat, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Miasma malware attack demonstrates how a single compromised developer account can cascade into a massive supply chain incident affecting thousands of downstream users. Attackers exploited valid GitHub credentials to inject malicious code into trusted Red Hat packages, which then leveraged legitimate SLSA provenance attestations to bypass security scanners. The self-propagating nature of the malware amplified the impact by automatically targeting other packages accessible to the infected developer. This incident underscores the critical importance of securing developer accounts and implementing robust supply chain security measures, as modern software development's interconnected nature means a single breach can rapidly spread across entire ecosystems.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- malware — Miasma
- malware — Mini Shai-Hulud