Miasma Mini Shai-Hulud Hits ImmobiliareLabs npm Packages
Miasma Mini Shai-Hulud supply chain campaign compromises 22 ImmobiliareLabs Backstage npm packages on June 26, 2026.
The Miasma Mini Shai-Hulud supply chain campaign expanded to compromise legitimate npm packages under the @immobiliarelabs scope, including Backstage plugins for GitLab integration and LDAP authentication. The attack followed the pattern of prior waves: compromising maintainer infrastructure, publishing malicious package versions with hidden JavaScript payloads, and stealing developer and CI/CD secrets. The campaign exploits a GitHub Actions privilege escalation via deployment-triggered workflows and a compromised third-party action (codfish/semantic-release-action) to gain access to npm publishing credentials.
AI summary of the linked source. Not reviewed by an editor. How this works
Run ImmobiliareLabs?
Get an email when a new story names ImmobiliareLabs, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThe Miasma Mini Shai-Hulud campaign demonstrates how attackers can weaponize legitimate software distribution channels by compromising maintainer infrastructure and injecting malicious payloads into trusted npm packages. By exploiting a privilege escalation flaw in GitHub Actions deployment workflows and a compromised third-party action (codfish/semantic-release-action), attackers gained the ability to publish malicious package versions without raising immediate suspicion. Developer and CI/CD secrets were silently exfiltrated, meaning downstream consumers of these packages were exposed without any visible indicators of compromise. This attack underscores the cascading trust problem in modern software supply chains: one compromised maintainer or third-party action can propagate malicious code to thousands of dependent projects.
What helps against this
How we list vendors
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Secrets management
API keys, tokens and passwords stop leaking from code, chat and configuration files.
- Software supply chain security
Malicious and vulnerable open-source packages are caught before they ship.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- hash_sha256 — dfcdec5f43cc8d127084a2ac4d66499f13bae7f49167e3291a6f1a70738772d1
- hash_sha256 — 1e7b04a9a4a25eb7928821a5519b0a40f7afe0f6042a6860c918b62d369096ed
- hash_sha256 — ef641e956f91d501b748085996303c96a64d67f63bfeef0dda175e5aa19cca90
- malware — Miasma Mini Shai-Hulud
- malware — Phantom Gyp