# Critical Supply Chain Attack: Miasma Worm Compromises Red Hat npm Packages with Credential Theft


A sophisticated supply chain attack campaign known as Miasma has successfully compromised packages in the @redhat-cloud-services npm namespace, injecting malicious code that steals credentials, harvests secrets from developer machines, and propagates itself across affected systems. Security researchers have confirmed the attack employs advanced tactics including install-time code execution, CI/CD pipeline targeting, and encrypted exfiltration channels—marking it as a high-severity threat to the broader npm ecosystem and Red Hat's downstream customers.


The compromised packages have been yanked from npm, but the attack represents a critical vulnerability in open-source supply chains and raises serious questions about package namespace security and dependency verification practices.


## The Threat


Miasma is a self-propagating worm designed to establish persistence across developer environments and corporate infrastructure. Upon installation, the malicious packages execute code that:


  • Harvests credentials and secrets from developer machines, including SSH keys, API tokens, environment variables, and authentication files
  • Targets CI/CD systems by scanning for and exfiltrating pipeline configuration files and access credentials
  • Propagates automatically by modifying package.json files and registry configurations to infect downstream dependencies
  • Encrypts exfiltration to evade detection and protect command-and-control communications
  • Establishes persistence through multiple mechanisms to survive package updates and system restarts

  • The worm's design suggests operators are targeting high-value development environments—focusing on developers with access to critical infrastructure, cloud services, and enterprise systems.


    ## Background and Context


    ### Red Hat's npm Presence


    Red Hat maintains a presence in the npm ecosystem through the @redhat-cloud-services namespace, which provides utility packages and SDKs for developers building applications on Red Hat's cloud platforms and services. The compromised packages target organizations and developers who depend on Red Hat's tooling, making this a supply chain attack with potentially thousands of downstream victims.


    ### Supply Chain Attack Evolution


    This attack follows an established pattern of sophisticated npm ecosystem compromises:


  • 2023: XZ Utils backdoor (pre-supply-chain attack) demonstrated that even trusted maintainers can be compromised
  • 2022: Codecov supply chain attack affected thousands of organizations through a widespread CI/CD platform
  • 2021: ua-parser-js, flatmap-stream, and other npm packages were compromised with credential-stealing malware

  • Miasma represents an evolution of these tactics, combining automated propagation with targeted CI/CD exfiltration—making it significantly more dangerous than previous single-package compromises.


    ### The npm Namespace Vulnerability


    The attack exploits a persistent weakness in npm's security model: namespace authentication. While npm now requires two-factor authentication for publish operations, it does not automatically verify that package publishers have explicit authorization from the organization owning a namespace. Attackers who gain access to a single account (through phishing, credential stuffing, or social engineering) can often publish to entire namespaces if the account has sufficient permissions.


    ## Technical Details


    ### Attack Execution Flow


    The Miasma worm operates in stages:


    Stage 1: Installation Trigger

  • Malicious code executes during npm install via install scripts in package.json
  • Modern npm allows execution during installation, creating a window for initial payload delivery
  • No user interaction required beyond running a standard package installation

  • Stage 2: Credential Enumeration

    The worm scans the compromised system for:

  • SSH keys in ~/.ssh/ and related directories
  • Git credentials in .gitconfig and git credential storage
  • NPM tokens in .npmrc files
  • Environment files (.env, .env.local) containing API keys
  • CI/CD configuration files (.github/workflows/, .gitlab-ci.yml, Jenkins configs)
  • Cloud provider credentials (AWS, GCP, Azure configuration files)
  • Kubernetes and container registry credentials

  • Stage 3: Propagation

  • Modifies package.json and package-lock.json in discovered projects
  • Injects the malicious package as a dependency in transitive dependencies
  • Targets monorepo structures to maximize spread
  • Scans for private npm registries and attempts to publish to them

  • Stage 4: Command & Control

  • Establishes encrypted communication channels to command servers
  • Sends exfiltrated credentials through steganographic channels to evade detection
  • Receives instructions to disable security tools, delete logs, or launch secondary attacks

  • ## Implications


    ### Immediate Risk


    Organizations and developers affected by Miasma face critical risk:


    | Risk Category | Impact |

    |---------------|--------|

    | Credential Compromise | SSH keys, API tokens, and authentication credentials exposed to attackers |

    | CI/CD Pipeline Access | Attackers gain ability to modify code, push malicious updates, or access production systems |

    | Lateral Movement | Compromised developer machines become entry points for internal network penetration |

    | Supply Chain Propagation | Organizations may unknowingly distribute the worm to their own customers via packages and deployments |


    ### Affected Organizations


    High-risk targets include:


  • Development teams using Red Hat cloud services and tooling
  • Enterprise organizations with Red Hat infrastructure dependencies
  • Software vendors whose products depend on @redhat-cloud-services packages
  • CI/CD pipeline operators relying on any affected package

  • ### Long-Term Ecosystem Impact


    Miasma demonstrates a critical weakness in npm's security model: the reliance on human-managed credentials without adequate verification of namespace ownership. This attack will likely prompt:


  • Stricter npm namespace verification requirements
  • Mandatory package signing and verification
  • Increased adoption of Software Bill of Materials (SBOM) tools
  • Enhanced scrutiny of install-time code execution

  • ## Recommendations


    ### For Developers and Organizations


    Immediate Actions:


    1. Audit dependency trees — identify any projects that installed affected @redhat-cloud-services packages in the last 30 days

    2. Rotate all credentials — regenerate SSH keys, API tokens, and authentication credentials that may have been exposed

    3. Scan development machines — use endpoint detection tools to identify signs of Miasma infection

    4. Review CI/CD logs — check for unauthorized access, credential exfiltration, or suspicious publish activities

    5. Patch and update — upgrade to patched versions of affected packages as Red Hat releases them


    Long-Term Hardening:


  • Implement secret scanning — use tools like git-secrets and TruffleHound to prevent credential commits
  • Enable 2FA everywhere — require two-factor authentication for all critical service accounts
  • Restrict install scripts — configure npm to block or warn on install scripts: npm config set ignore-scripts true
  • Use lock files — commit package-lock.json to enforce exact dependency versions
  • Monitor package changes — use services like Snyk, WhiteSource, or Dependabot to detect unexpected updates
  • Adopt SBOM practices — maintain software bills of materials to track all dependencies

  • ### For Package Maintainers


  • Implement cryptographic signing of all package releases
  • Require approval workflows before publishing to namespaces
  • Conduct automated security scanning in CI/CD pipelines
  • Disable install-time scripts when possible, or require explicit user opt-in
  • Monitor for unauthorized account access and suspicious publishing activity

  • ---


    ## HackWire Analysis


    Miasma represents a fundamental failure in npm's access control model, and Red Hat's compromised namespace is merely the latest evidence that relying on single-factor authentication for critical infrastructure is untenable.


    What makes this attack particularly concerning is not just its technical sophistication—credential harvesting and CI/CD targeting are now table-stakes for modern supply chain attacks—but rather its self-propagating design. By modifying downstream package.json files, Miasma turns victim organizations into unwitting distributors, creating a cascading infection vector that turns the npm ecosystem into its own attack surface.


    The timing matters: as enterprises increasingly adopt microservices architectures and modular development practices, dependency on third-party npm packages has become near-universal. A single compromised namespace can reach thousands of organizations, making supply chain attacks like Miasma exponentially more efficient than traditional breach-and-exfiltrate approaches.


    The real lesson isn't that npm is broken—it's that we've built critical infrastructure on a foundation that treats authentication as optional. The npm ecosystem has grown to power applications handling sensitive data, financial transactions, and healthcare systems, yet package namespace verification remains embarrassingly weak. Red Hat—a company trusted by enterprises precisely because of its security focus—should not have been vulnerable to what amounts to an account compromise.


    Organizations should treat Miasma as a wake-up call: the "implicit trust" model of open-source is incompatible with modern security requirements. Lock your supply chains tighter, assume any transitive dependency can become hostile, and stop treating package updates as lower-risk than code reviews.


    HackWire Editorial


    ## Related Coverage


  • Read more in our [Breaches](https://www.hackwire.news/category/breaches) coverage
  • Cross-reference with [Vulnerabilities](https://www.hackwire.news/category/vulnerabilities) and [Malware](https://www.hackwire.news/category/malware)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)