Executive Summary
In June 2026, a sophisticated supply chain attack known as 'Miasma' compromised 32 npm packages under Red Hat's @redhat-cloud-services namespace. The attackers gained access through a compromised Red Hat employee's GitHub account, allowing them to push malicious commits that bypassed standard peer reviews. These commits exploited GitHub Actions workflows to publish trojanized package versions to the public npm registry. Upon installation, these packages executed an obfuscated payload designed to steal credentials from various platforms, including GitHub, AWS, Azure, and Google Cloud Platform. The malware also attempted to propagate by compromising additional maintainer packages and, in some cases, could destroy the maintainer’s home directory. (microsoft.com)
This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The Miasma campaign highlights the need for enhanced security measures in CI/CD pipelines and vigilant monitoring of package repositories to prevent unauthorized access and mitigate the risk of widespread credential theft and system compromise.
Why This Matters Now
The Miasma attack exemplifies the growing sophistication of supply chain threats, emphasizing the urgent need for organizations to fortify their CI/CD pipelines and implement stringent access controls to safeguard against similar breaches.
Attack Path Analysis
The Miasma malware campaign began with the compromise of developer accounts, leading to the injection of malicious code into npm packages and GitHub repositories. This allowed attackers to escalate privileges by executing preinstall hooks that deployed obfuscated scripts to harvest sensitive credentials. The malware then moved laterally by propagating through compromised packages and GitHub Actions workflows, embedding itself into various development environments. For command and control, the attackers utilized GitHub repositories to exfiltrate stolen credentials and maintain control over infected systems. Exfiltration was achieved by uploading harvested secrets to public GitHub repositories, facilitating unauthorized access to cloud services. The impact included unauthorized access to cloud resources, potential data breaches, and disruption of development pipelines.
Kill Chain Progression
Initial Compromise
Description
Attackers compromised developer accounts to inject malicious code into npm packages and GitHub repositories.
MITRE ATT&CK® Techniques
Compromise Software Dependencies and Development Tools
Valid Accounts
JavaScript
Credentials in Files
Private Keys
Web Protocols
DLL Side-Loading
Domain Generation Algorithms
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Ensure all system components are protected from known vulnerabilities
Control ID: 6.2
NYDFS 23 NYCRR 500 – Cybersecurity Policy
Control ID: 500.03
DORA – ICT Risk Management Framework
Control ID: Article 5
CISA ZTMM 2.0 – Supply Chain Risk Management
Control ID: 3.1
NIS2 Directive – Security of Network and Information Systems
Control ID: Article 21
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Supply chain attacks targeting npm packages and GitHub Actions directly compromise software development workflows, CI/CD pipelines, and code repositories critical to this sector.
Information Technology/IT
Miasma malware's infiltration of development tools and package managers poses severe risks to IT infrastructure, deployment processes, and client software delivery systems.
Financial Services
Supply chain compromises in development ecosystems threaten financial applications' integrity, potentially enabling data exfiltration and violating PCI DSS compliance requirements outlined in validated capabilities.
Health Care / Life Sciences
Healthcare software supply chain attacks risk patient data exposure and HIPAA violations, particularly concerning given the sector's reliance on third-party development frameworks.
Sources
- Miasma Malware Targets npm Packages and GitHub Actions in Supply Chain Attackhttps://thehackernews.com/2026/06/miasma-malware-targets-npm-packages-and.htmlVerified
- Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaignhttps://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/Verified
- Miasma Supply Chain Attack Hits Red Hat @redhat-cloud-services Packageshttps://www.invisirisk.com/blog/red-hat-npm-supply-chain-attack-miasma-hits-redhat-cloud-services/Verified
- Leo Platform npm packages compromised with Phantom Gyp Miasma toolkithttps://corgea.com/research/leo-platform-npm-phantom-gyp-miasma-june-2026Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Aviatrix Zero Trust CNSF is pertinent to this incident as it could likely limit the attacker's ability to move laterally and exfiltrate data by enforcing strict segmentation and identity-based access controls.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: The attacker's ability to inject malicious code into repositories would likely be constrained by enforcing strict identity-based access controls and continuous verification of workload behavior.
Control: Zero Trust Segmentation
Mitigation: The attacker's ability to escalate privileges by executing malicious scripts would likely be limited by enforcing strict segmentation and identity-based access controls.
Control: East-West Traffic Security
Mitigation: The attacker's ability to move laterally across development environments would likely be constrained by enforcing east-west traffic security and workload isolation.
Control: Multicloud Visibility & Control
Mitigation: The attacker's ability to maintain command and control over infected systems would likely be limited by enforcing multicloud visibility and control.
Control: Egress Security & Policy Enforcement
Mitigation: The attacker's ability to exfiltrate sensitive data to external repositories would likely be constrained by enforcing strict egress security and policy enforcement.
The overall impact of unauthorized access and data breaches would likely be reduced by enforcing strict segmentation and identity-based access controls.
Impact at a Glance
Affected Business Functions
- Software Development
- Continuous Integration/Continuous Deployment (CI/CD) Pipelines
- Cloud Infrastructure Management
Estimated downtime: 7 days
Estimated loss: $500,000
Developer credentials, cloud service tokens, and CI/CD secrets were compromised, potentially leading to unauthorized access to code repositories and cloud resources.
Recommended Actions
Key Takeaways & Next Steps
- • Implement Zero Trust Segmentation to restrict lateral movement within development environments.
- • Enforce Egress Security & Policy Enforcement to monitor and control outbound traffic, preventing unauthorized data exfiltration.
- • Utilize Multicloud Visibility & Control to detect and respond to anomalous activities across cloud platforms.
- • Deploy Threat Detection & Anomaly Response mechanisms to identify and mitigate malicious behaviors in real-time.
- • Regularly audit and rotate credentials to minimize the risk of unauthorized access due to compromised secrets.
