The Miasma campaign is a supply chain attack that compromised over 90 versions of @redhat-cloud-services npm packages. The malicious code executes during the preinstall phase, stealing credentials from GitHub, cloud services, and local machines. It propagates by republishing compromised packages, effectively worming through developer and CI/CD environments. This attack leverages trusted package names to maintain persistence and evade detection. The campaign was detailed by Microsoft Security Blog, highlighting the attack vector, affected components, and the nature of credential theft. No direct patch or vendor advisory is referenced, and the attack is not cloud-service hosted, indicating remediation depends on package updates and developer vigilance.

The attack results in theft of sensitive credentials from developer machines and CI/CD environments, including GitHub tokens and cloud platform credentials. This can lead to unauthorized access to source code repositories, cloud resources, and potentially further lateral movement within affected organizations. The malicious packages also self-propagate by republishing under trusted package names, increasing the scope of infection. The medium severity reflects the significant but not immediately critical impact, given the need for local execution and developer environment compromise.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should monitor official Red Hat and npm advisories for updates or patches addressing the compromised packages. Until patches are available, avoid using affected versions of @redhat-cloud-services packages and consider auditing CI/CD pipelines and developer environments for suspicious activity. Review the detailed Microsoft Security Blog article for recommended detection and containment strategies. No vendor advisory explicitly states 'no action required' or 'already mitigated,' so proactive investigation and cautious package management are advised.