Red Hat packages compromised by Miasma malware supply‑chain attack

On 1 June 2026 security researchers identified a supply‑chain compromise that inserted malicious code into 32 Red Hat‑maintained npm packages. Attackers accessed a legitimate Red Hat employee’s GitHub account and pushed hidden commits that added a GitHub Actions workflow to obtain short‑lived OIDC tokens. Those tokens were used to publish back‑doored packages to the public npm registry, which subsequently downloaded 80,000–117,000 times weekly.

The malware, dubbed “Miasma,” acts as a self‑propagating worm and credential stealer. When a compromised package is installed, a pre‑install script harvests cloud credentials for Google Cloud, Microsoft Azure, AWS, SSH keys, passwords and AI‑tool tokens, then attempts to republish other packages the compromised identity can modify. Registry administrators revoked the malicious versions within hours, and security teams were advised to rotate affected credentials and block install scripts.

The incident highlights the risks of supply‑chain attacks that exploit trusted developer accounts, potentially exposing a wide range of development pipelines and cloud environments.