Red Hat npm packages compromised with Miasma credential stealer

Affected Systems

Over 30 npm packages in the '@redhat-cloud-services' namespace on npm registry. Affects developers and CI/CD pipelines consuming these packages. Specific package names and versions not yet disclosed.

Exploitation Status

Active supply-chain attack confirmed. Malicious packages were published to npm registry and available for download. Miasma malware (Shai-Hulud variant) actively steals developer credentials from infected systems.

Business Impact

Developers who installed compromised packages have credentials at risk including npm tokens, SSH keys, cloud provider credentials, and source code access tokens. Compromised CI/CD pipelines may expose production secrets. Potential for lateral movement into Red Hat customer environments and further supply-chain propagation if stolen credentials are used to publish additional malicious packages.

Urgency

🔴 Immediate

Recommended Actions

• Audit all systems and CI/CD pipelines for installations of '@redhat-cloud-services/*' packages and check against Red Hat's advisory for compromised package list and versions
• Rotate all developer credentials on affected systems including npm tokens, GitHub/GitLab tokens, SSH keys, AWS/Azure/GCP credentials, and any secrets accessible from developer workstations
• Review npm audit logs and package-lock.json files for unexpected package installations or version changes in the '@redhat-cloud-services' namespace
• Scan developer workstations and build servers with updated EDR/AV signatures for Miasma/Shai-Hulud malware indicators
• Implement package integrity verification using npm package signatures and lock files, restrict npm registry access to approved packages only