[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fPee2OOf3-HlfEZMnP7IlwUFq1eUa9zYqSqSrJ3jFQec":3},{"article":4,"iocs":58,"watch_terms":64,"solutions":65,"lesson":161},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"219a041d-8c26-4c6f-bf95-8196c29d11d5","Miasma Malware Hits 32 Red Hat Packages via Compromised GitHub Account","miasma-malware-hits-32-red-hat-packages-via-compromised-github-account-b7d159","32 Red Hat npm packages compromised by Miasma malware expose cloud tokens, CI\u002FCD secrets and developer credentials in supply chain attack.","On June 1, 2026, researchers discovered that 32 Red Hat npm packages under @redhat-cloud-services were compromised after attackers gained access to a Red Hat employee's GitHub account and injected malicious code. The Miasma malware—a self-propagating worm variant based on the Mini Shai-Hulud framework—steals cloud tokens, SSH keys, and developer credentials; it also self-replicates by targeting other packages the infected developer can access. The attack affected 96 package versions downloaded 80,000–117,000 times weekly and leveraged valid SLSA provenance attestations to evade security scanners.","32 Red Hat npm packages compromised via stolen GitHub account; Miasma malware steals credentials and CI\u002FCD tokens.","https:\u002F\u002Fhackread.com\u002Fmiasma-malware-red-hat-packages-github-account\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Fmiasma-malware-red-hat-packages-github-account.jpg","2026-06-05T19:14:40+00:00","2026-06-05T20:00:08.005349+00:00",9,[17,20,23,26,29],{"name":18,"type":19},"Red Hat","vendor",{"name":21,"type":22},"Red Hat Hybrid Cloud Console","product",{"name":24,"type":25},"npm","technology",{"name":27,"type":28},"TeamPCP","threat_actor",{"name":30,"type":31},"Miasma","campaign","26b0b636-0e31-4db1-bffb-61bdf9f20a58",{"id":32,"icon":34,"name":35,"slug":36},null,"Supply Chain","supply-chain",[38,43,48,53],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2e06f76c-d5b9-4f54-9eef-4d3447b10730","Breaches","breaches",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5","Malware","malware",{"category":49},{"id":50,"icon":34,"name":51,"slug":52},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",{"category":54},{"id":55,"icon":34,"name":56,"slug":57},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[59,61],{"type":47,"value":30,"context":60},"Self-propagating credential-stealing worm variant based on Mini Shai-Hulud; deployed via compromised Red Hat npm packages.",{"type":47,"value":62,"context":63},"Mini Shai-Hulud","Open-source malware framework published by TeamPCP on BreachForums; basis for Miasma variant.",[18,21],{"controls":66,"vendors":147},[67,96,125],{"slug":68,"name":69,"problem":70,"products":71},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[72,80,88],{"vendor_slug":73,"vendor_name":74,"vendor_logo":75,"product_slug":76,"product_name":77,"url":78,"description":79},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":81,"vendor_name":82,"vendor_logo":83,"product_slug":84,"product_name":85,"url":86,"description":87},"acalvio","Acalvio","\u002Fvendor-logos\u002Facalvio.png","shadowplex-identity-protection","ShadowPlex Identity Protection","https:\u002F\u002Fwww.acalvio.com\u002Fproducts\u002Fidentity-protection\u002F","Decoy accounts and credentials that expose identity attacks and credential misuse early.",{"vendor_slug":89,"vendor_name":90,"vendor_logo":91,"product_slug":92,"product_name":93,"url":94,"description":95},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"slug":97,"name":98,"problem":99,"products":100},"secrets-management","Secrets management","API keys, tokens and passwords stop leaking from code, chat and configuration files.",[101,109,117],{"vendor_slug":102,"vendor_name":103,"vendor_logo":104,"product_slug":105,"product_name":106,"url":107,"description":108},"gitguardian","GitGuardian","\u002Fvendor-logos\u002Fgitguardian.png","gitguardian-platform","GitGuardian Secrets Detection","https:\u002F\u002Fwww.gitguardian.com\u002F","Finds and helps remediate secrets leaked in repositories, CI pipelines and chat tools.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},"github","GitHub","\u002Fvendor-logos\u002Fgithub.png","advanced-security","GitHub Advanced Security","https:\u002F\u002Fgithub.com\u002Fsecurity\u002Fadvanced-security","Dependency review, code scanning and secret scanning with push protection.",{"vendor_slug":118,"vendor_name":119,"vendor_logo":120,"product_slug":121,"product_name":122,"url":123,"description":124},"hashicorp","HashiCorp","\u002Fvendor-logos\u002Fhashicorp.png","vault","HashiCorp Vault","https:\u002F\u002Fwww.hashicorp.com\u002Fen\u002Fproducts\u002Fvault","Secrets management with short-lived credentials and encryption as a service.",{"slug":126,"name":127,"problem":128,"products":129},"software-supply-chain","Software supply chain security","Malicious and vulnerable open-source packages are caught before they ship.",[130,138,139],{"vendor_slug":131,"vendor_name":132,"vendor_logo":133,"product_slug":134,"product_name":135,"url":136,"description":137},"snyk","Snyk","\u002Fvendor-logos\u002Fsnyk.png","snyk-open-source","Snyk Open Source","https:\u002F\u002Fsnyk.io\u002Fproduct\u002Fopen-source-security-management\u002F","Finds and fixes vulnerable open-source dependencies in code and pipelines.",{"vendor_slug":110,"vendor_name":111,"vendor_logo":112,"product_slug":113,"product_name":114,"url":115,"description":116},{"vendor_slug":140,"vendor_name":141,"vendor_logo":142,"product_slug":143,"product_name":144,"url":145,"description":146},"jfrog","JFrog","\u002Fvendor-logos\u002Fjfrog.png","jfrog-xray","JFrog Xray","https:\u002F\u002Fjfrog.com\u002Fxray\u002F","Software composition analysis and SBOM generation for artifacts.",[148,154,156],{"slug":149,"name":150,"logo_path":151,"roles":152},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png",[153],"reported_by",{"slug":131,"name":132,"logo_path":133,"roles":155},[153],{"slug":157,"name":158,"logo_path":159,"roles":160},"wiz","Wiz","\u002Fvendor-logos\u002Fwiz.png",[153],{"slug":162,"title":163,"body":164,"framework_refs":165,"framework_notes":172},"supply-chain-attack-through-compromised-developer-account-highlights-need-for-enhanced-security-cont","Supply Chain Attack Through Compromised Developer Account Highlights Need for Enhanced Security Controls","The Miasma malware attack demonstrates how a single compromised developer account can cascade into a massive supply chain incident affecting thousands of downstream users. Attackers exploited valid GitHub credentials to inject malicious code into trusted Red Hat packages, which then leveraged legitimate SLSA provenance attestations to bypass security scanners. The self-propagating nature of the malware amplified the impact by automatically targeting other packages accessible to the infected developer. This incident underscores the critical importance of securing developer accounts and implementing robust supply chain security measures, as modern software development's interconnected nature means a single breach can rapidly spread across entire ecosystems.",[166,167,168,169,170,171],"CIS Control 5","CIS Control 16","NIST SP 800-161","NIST AC-2","SLSA Level 3","SSDF PW.4.1",{"NIST AC-2":173,"SSDF PW.4.1":174,"SLSA Level 3":175,"CIS Control 5":176,"CIS Control 16":177,"NIST SP 800-161":178},"Account management with monitoring of developer accounts helps detect stolen GitHub credentials being used.","Protecting software from tampering includes securing developer accounts and verifying release integrity.","SLSA Level 3 requires hardened builds and verifiable provenance, making injected code in packages much harder to hide.","Account management, including MFA and monitoring for maintainers, protects developer accounts like the one used in the Miasma attack.","Application security includes securing build and release processes, so compromised accounts cannot inject code into packages.","Supply chain risk management helps downstream users assess and verify the packages they depend on."]