Red Hat npm supply chain attack "Miasma" — 32 @redhat-cloud-services packages, SLSA bypass via OIDC abuse, new GCP/Azure identity collectors
Source Reddit BlueTeam
Discussion
The Miasma campaign is a supply chain attack targeting Red Hat npm packages under the @redhat-cloud-services namespace. Attackers used a compromised Red Hat employee's GitHub account to push malicious commits and abused GitHub Actions OIDC workflows to publish packages with valid SLSA provenance, bypassing supply chain verification. This attack highlights a weakness in the trust model of npm publishing workflows, where the build pipeline's trust boundary can be circumvented upstream. The campaign also includes new variants that collect cloud identities from GCP and Azure, escalating the threat beyond credential harvesting to active cloud access enumeration. Attribution remains uncertain, with possible links to the publicly released TeamPCP toolkit. No known exploits in the wild or official patches have been reported yet.
r/blueteamsec (opens in a new tab)u/Expert_Sort74340 points0 comments
So I've been going through the Wiz, JFrog, and Aikido analyses of the Miasma campaign that dropped June 1. A few things are worth unpacking beyond the headlines.
The attack used a compromised Red Hat employee's GitHub account to push malicious commits directly, then triggered GitHub Actions OIDC to publish packages to npm with valid SLSA provenance. This is the part that should concern everyone: the packages passed supply chain verification because the build pipeline itself was injected upstream of the attestation step. SLSA didn't fail here — its trust boundary was just further back than people assumed.
The new GCP and Azure identity collectors in this Shai-Hulud variant also feel like a notable escalation. Previous versions were credential harvesters. This one is actively enumerating cloud access — which is a different kind of threat model.
Attribution is genuinely uncertain: TeamPCP published the toolkit publicly in May, so this could be a copycat. The "Miasma" branding (replacing Dune refs with Greek mythology) could support that. https://www.techgines.com/post/red-hat-npm-supply-chain-attack-miasma
I previously covered the original TeamPCP PyPI campaign here if you want background on the Shai-Hulud lineage: https://www.techgines.com/post/pytorch-lightning-supply-chain-attack-pypi-teampcp
Question for the community: given that OIDC trusted publishing was the attack vector here, what's actually the correct trust model for npm publishing workflows? Does restricting OIDC to specific branch patterns meaningfully reduce risk, or is a compromised developer account always going to find a way through?