A supply chain attack dubbed Miasma has compromised over 30 official Red Hat npm packages with credential-stealing malware.
A highly sophisticated supply chain attack hijacked a Red Hat developer account to inject the Miasma malware into more than 30 official npm packages under the @redhat-cloud-services scope. During installation, these backdoored packages silently harvest sensitive information, including cloud logins, CI/CD secrets, and Kubernetes tokens, presenting a severe threat to organizations using these services.
Compromising trusted developer accounts remains the easiest and most high-impact route for attackers to bypass enterprise network perimeters.
* Attackers are increasingly shifting left to target developer identities and registry access.
* The automatic execution of scripts during npm package installation continues to be a dangerous default behavior that requires strict sandboxing.
* Organization-wide implementation of multi-factor authentication (MFA) and least-privilege CI/CD policies is critical to mitigating registry compromises.
DISCOVERED
1h ago
2026-06-01
PUBLISHED
1h ago
2026-06-01
RELEVANCE
AUTHOR
Syntax
