What the Miasma campaign reveals about the new supply chain threat model and the underground market for developer credentials
A stolen session cookie sat in underground markets for seven weeks before attackers used it to poison 32 Red Hat packages in the npm software registry, an example of the industrial approach behind modern supply chain attacks. Key takeaways Miasma is a self-propagating npm worm derived from Mini Shai-Hulud that TeamPCP open-sourced on May 12. The public release of the full weaponized toolchain means any operator can now replicate structurally identical supply chain campaigns. The Miasma campaign compromised 89-plus npm packages across three waves (June 1-5), affecting Red Hat, Vapi.ai, and Microsoft Azure repositories. The worm produced malicious packages with valid SLSA Build Level 3 provenance attestations, defeating the highest tier of supply-chain integrity verification. The root cause was a stolen developer credential that sat in infostealer logs for seven weeks before weaponization. This infostealer-to-supply-chain pipeline is the defining pattern of the Developer Credential Economy. The Miasma campaign’s third wave (June 5) introduced a significant escalation: persistence files that target AI coding assistants (Claude Code, Cursor, Gemini CLI, VS Code), expanding the attack surface from package registries to the developer’s local environment. Relying on execution-layer detection, such as EDR, is insufficient against supply chain threats because EDR tools lack visibility into the ephemeral CI/CD environments where credential theft and weaponization occur. Organizations should treat developer credentials as control-plane infrastructure and adopt a phased Continuous Threat Exposure Management (CTEM) approach: harden the generation layer, neutralize harvested secrets in real time, and enforce human-gated publishing controls. Background on the Miasma worm and npm supply chain attack On June 1, the Miasma self-propagating worm compromised 32 official npm packages under the @redhat-cloud-services namespace, delivering a credential-harvesting payload to an estimated 80,000 to 117,000 weekly downloads. Within five days, the campaign escalated through three distinct attack waves and forced GitHub to disable 73 repositories across four Microsoft organizations . The technical details of the Miasma supply-chain attack are alarming: valid Supply Chain Levels for Software Artifacts (SLSA) provenance attestations on malicious packages; a novel execution technique that bypasses install-script monitoring; and a new persistence mechanism that targets AI coding assistants. But the most important detail is a timestamp. Dark web monitoring firm Whiteintel detected a Red Hat employee’s GitHub credential and session cookie in infostealer logs on April 13. A second sighting appeared on May 15. The credential sat in underground markets for approximately seven weeks before attackers weaponized it on June 1. That seven-week gap is the signature of an emerging threat model that Tenable’s Research Special Operations (RSO) team calls the Developer Credential Economy , and has been tracking since March 2026. The Developer Credential Economy is a structured black market for highly privileged developer credentials where open-source supply chain compromises function as credential generation infrastructure, underground markets serve as the distribution layer, and multiple threat actors with distinct motivations weaponize the harvested access downstream. The Miasma campaign is the clearest example of this model to date, and it validates a pattern that has been accelerating across the npm, PyPI, and GitHub ecosystems throughout 2026. The three-layer economy, explained through Miasma When it first assessed this pattern in March, Tenable RSO built the analysis around the TeamPCP cascading campaign (Trivy, KICS, LiteLLM, Telnyx, and 66+ npm packages) and the Sapphire Sleet/UNC1069 Axios compromise . The thesis identified a three-layer structure: credential generation, distribution, and weaponization. Three months later, the Miasma campaign validates each layer with striking clarity. Layer Actor / group Operational focus Primary targets Miasma validation Generation TeamPCP Bulk credential harvesting via tool exploitation Trivy, KICS, TanStack, Red Hat npm scope Miasma's payload sweeps GitHub tokens, cloud credentials, CI/CD secrets, SSH keys, and .env files from every infected environment Distribution Underground markets, infostealer aggregators Credential brokering and tooling proliferation Stolen developer credentials; open-sourced worm code Red Hat employee credential sat in infostealer logs for seven weeks before weaponization; Shai-Hulud source published May 12 Weaponization Sapphire Sleet (DPRK-nexus), LAPSUS$, Miasma operator, copycat actors State-sponsored exfiltration, data theft, cascading supply chain compromise Axios (npm), Mercor AI, @vapi-ai/server-sdk, Azure/durabletask Each Miasma wave generates A fresh credential pool, feeding the next wave and enabling downstream actors Layer 1: Credential generation The Developer Credential Economy’s first layer is extraction. Threat actors compromise developer tooling and open-source infrastructure not primarily to distribute malware to end users, but to harvest the credentials those environments contain, such as GitHub tokens, npm publishing tokens, cloud provider credentials, CI/CD secrets, SSH keys, and API keys. TeamPCP pioneered this at scale beginning in September 2025 with the original Shai-Hulud worm. Its defining innovation was cascading credential extraction: compromise one trusted tool, harvest the credentials it holds, and use those credentials to compromise the next tool in the dependency chain. The Trivy vulnerability scanner compromise yielded CI/CD runner secrets. Those secrets enabled the KICS compromise . KICS yielded additional cloud credentials. Each link in the chain generated a broader set of privileged access. By May, TeamPCP had refined this into the Mini Shai-Hulud variant, which introduced two capabilities that made the generation layer dramatically more efficient: Wormable propagation : The malware queries the npm registry for every package the compromised identity can publish, and republishes itself across all of them automatically. CI/CD pipeline hijack via OpenID Connect (OIDC) token extraction : Rather than stealing static credentials, Mini Shai-Hulud requests short-lived OIDC tokens through GitHub Actions, enabling it to publish packages with valid cryptographic provenance. In the Miasma supply chain campaign, this generation layer operated through a Red Hat employee’s compromised GitHub account. The worm’s payload swept the infected environment for: GitHub tokens and personal access tokens npm publishing tokens AWS, GCP, and Azure cloud credentials HashiCorp Vault tokens Kubernetes service account tokens SSH private keys Docker registry credentials GPG keys .env files The June variant added dedicated collectors for GCP and Azure cloud identities, going beyond secret extraction to enumerate all cloud access the infected machine holds. Every machine that ran npm install against a compromised @redhat-cloud-services package version became a credential generation node. Layer 2: Distribution The second layer is the marketplace. Stolen credentials flow from the generation layer into underground markets, infostealer log aggregators, and access brokering services, where they become available to any buyer. The Miasma supply chain-attack timeline makes this layer visible in a way previous campaigns did not. Whiteintel detected the Red Hat employee’s GitHub credential and session cookie in infostealer logs on April 13. That credential was not generated by a targeted supply chain attack against Red Hat; a commodity infostealer harvested it, one of 13.2 million infostealer infections that SpyCloud's 2025 Identity Exposure Report documented as producing an average of 50 credentials per infection. The credential entered the distribution layer as one data point among billions: SpyCloud recaptured 5.3 billion credential pairs, 18.1 million exposed API keys and tokens, and 8.6 billion stolen session cookies from criminal underground monitoring in 2025 alone. For seven weeks, the credential sat in the distribution layer before someone acted on it. That dwell time is the systemic gap that the Developer Credential Economy exploits. Organizations that do not monitor underground markets for exposed developer credentials are operating on the assumption that the generation-to-weaponization pipeline does not exist, or that it operates too slowly to matter. Miasma demonstrates that even a seven-week window, which is long by underground market standards, is more than sufficient for weaponization. The distribution layer was further amplified on May 12, when TeamPCP published the complete Mini Shai-Hulud source code on GitHub under an MIT License with the message “Shai-Hulud: Open Sourcing The Carnage.” The release included CI cache-poisoning scripts, the OIDC token extractor, and the credential stealer with its propagation logic. This is the supply chain equivalent of publishing a working exploit framework: the tooling itself became a distribution channel, lowering the barrier to entry for any operator who wants to run a structurally identical campaign. Layer 3: Weaponization The third layer is operational use. Actors with distinct motivations acquire credentials from the distribution layer and weaponize them against specific targets. In March, the RSO team documented at least three distinct actors operating from the same credential pool : TeamPCP harvested at scale: Sapphire Sleet/UNC1069 (DPRK-nexus) operationalized stolen npm tokens for financial gain through the Axios compromise and LAPSUS$ exploited compromised Tailscale VPN credentials from the LiteLLM breach for data theft from Mercor AI. The same credential ecosystem fed all three. Miasma’s weaponization layer continues to evolve, but the trajectory across its three waves demonstrates the pattern: Wave 1 (June 1) used the stolen R
AI Analysis
Technical Summary
The Miasma campaign is a sophisticated supply chain attack that used a stolen Red Hat employee’s GitHub credential and session cookie, which were exposed in infostealer logs and underground markets for approximately seven weeks before being weaponized. The attack involved a self-propagating npm worm derived from Mini Shai-Hulud, which compromised 89+ npm packages across three waves in June 2026, affecting major organizations including Red Hat, Vapi.ai, and Microsoft Azure. The worm automatically republished itself across all packages the compromised identity could publish and used short-lived OpenID Connect tokens to produce malicious packages with valid SLSA Build Level 3 provenance attestations, defeating the highest supply chain integrity verification. The campaign also introduced persistence files targeting AI coding assistants such as Claude Code, Cursor, Gemini CLI, and VS Code, thereby expanding the attack vector to developers' local environments. The attack is part of a broader emerging threat model called the Developer Credential Economy, which consists of three layers: credential generation (harvesting developer tokens and secrets), distribution (underground markets and infostealer logs), and weaponization (using stolen credentials for cascading supply chain compromises). The public release of the Mini Shai-Hulud source code further lowers the barrier for replication of such attacks. Traditional endpoint detection and response (EDR) tools are insufficient to detect these attacks due to lack of visibility into ephemeral CI/CD environments where credential theft and weaponization occur.
Potential Impact
The Miasma campaign compromised critical open-source supply chain infrastructure by injecting malicious code into trusted npm packages used by thousands of developers and organizations, including Red Hat and Microsoft Azure. The attack bypassed advanced supply chain integrity protections by using valid cryptographic provenance attestations, undermining trust in software supply chains. It expanded the attack surface to developers' local environments by targeting AI coding assistants, potentially enabling further credential theft and persistence. The campaign demonstrates how stolen developer credentials can be weaponized to cause widespread cascading supply chain compromises, affecting software integrity and potentially enabling data theft, unauthorized code execution, and further downstream attacks.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should treat developer credentials as critical control-plane infrastructure and implement a phased Continuous Threat Exposure Management (CTEM) approach. This includes hardening credential generation processes, actively neutralizing harvested secrets in real time, and enforcing human-gated publishing controls to prevent unauthorized package publication. Monitoring underground markets for exposed developer credentials is recommended to reduce dwell time between credential theft and weaponization. Traditional endpoint detection tools alone are insufficient; enhanced visibility into CI/CD environments and credential usage is necessary to detect and prevent such supply chain attacks.
What the Miasma campaign reveals about the new supply chain threat model and the underground market for developer credentials
Description
A stolen session cookie sat in underground markets for seven weeks before attackers used it to poison 32 Red Hat packages in the npm software registry, an example of the industrial approach behind modern supply chain attacks. Key takeaways Miasma is a self-propagating npm worm derived from Mini Shai-Hulud that TeamPCP open-sourced on May 12. The public release of the full weaponized toolchain means any operator can now replicate structurally identical supply chain campaigns. The Miasma campaign compromised 89-plus npm packages across three waves (June 1-5), affecting Red Hat, Vapi.ai, and Microsoft Azure repositories. The worm produced malicious packages with valid SLSA Build Level 3 provenance attestations, defeating the highest tier of supply-chain integrity verification. The root cause was a stolen developer credential that sat in infostealer logs for seven weeks before weaponization. This infostealer-to-supply-chain pipeline is the defining pattern of the Developer Credential Economy. The Miasma campaign’s third wave (June 5) introduced a significant escalation: persistence files that target AI coding assistants (Claude Code, Cursor, Gemini CLI, VS Code), expanding the attack surface from package registries to the developer’s local environment. Relying on execution-layer detection, such as EDR, is insufficient against supply chain threats because EDR tools lack visibility into the ephemeral CI/CD environments where credential theft and weaponization occur. Organizations should treat developer credentials as control-plane infrastructure and adopt a phased Continuous Threat Exposure Management (CTEM) approach: harden the generation layer, neutralize harvested secrets in real time, and enforce human-gated publishing controls. Background on the Miasma worm and npm supply chain attack On June 1, the Miasma self-propagating worm compromised 32 official npm packages under the @redhat-cloud-services namespace, delivering a credential-harvesting payload to an estimated 80,000 to 117,000 weekly downloads. Within five days, the campaign escalated through three distinct attack waves and forced GitHub to disable 73 repositories across four Microsoft organizations . The technical details of the Miasma supply-chain attack are alarming: valid Supply Chain Levels for Software Artifacts (SLSA) provenance attestations on malicious packages; a novel execution technique that bypasses install-script monitoring; and a new persistence mechanism that targets AI coding assistants. But the most important detail is a timestamp. Dark web monitoring firm Whiteintel detected a Red Hat employee’s GitHub credential and session cookie in infostealer logs on April 13. A second sighting appeared on May 15. The credential sat in underground markets for approximately seven weeks before attackers weaponized it on June 1. That seven-week gap is the signature of an emerging threat model that Tenable’s Research Special Operations (RSO) team calls the Developer Credential Economy , and has been tracking since March 2026. The Developer Credential Economy is a structured black market for highly privileged developer credentials where open-source supply chain compromises function as credential generation infrastructure, underground markets serve as the distribution layer, and multiple threat actors with distinct motivations weaponize the harvested access downstream. The Miasma campaign is the clearest example of this model to date, and it validates a pattern that has been accelerating across the npm, PyPI, and GitHub ecosystems throughout 2026. The three-layer economy, explained through Miasma When it first assessed this pattern in March, Tenable RSO built the analysis around the TeamPCP cascading campaign (Trivy, KICS, LiteLLM, Telnyx, and 66+ npm packages) and the Sapphire Sleet/UNC1069 Axios compromise . The thesis identified a three-layer structure: credential generation, distribution, and weaponization. Three months later, the Miasma campaign validates each layer with striking clarity. Layer Actor / group Operational focus Primary targets Miasma validation Generation TeamPCP Bulk credential harvesting via tool exploitation Trivy, KICS, TanStack, Red Hat npm scope Miasma's payload sweeps GitHub tokens, cloud credentials, CI/CD secrets, SSH keys, and .env files from every infected environment Distribution Underground markets, infostealer aggregators Credential brokering and tooling proliferation Stolen developer credentials; open-sourced worm code Red Hat employee credential sat in infostealer logs for seven weeks before weaponization; Shai-Hulud source published May 12 Weaponization Sapphire Sleet (DPRK-nexus), LAPSUS$, Miasma operator, copycat actors State-sponsored exfiltration, data theft, cascading supply chain compromise Axios (npm), Mercor AI, @vapi-ai/server-sdk, Azure/durabletask Each Miasma wave generates A fresh credential pool, feeding the next wave and enabling downstream actors Layer 1: Credential generation The Developer Credential Economy’s first layer is extraction. Threat actors compromise developer tooling and open-source infrastructure not primarily to distribute malware to end users, but to harvest the credentials those environments contain, such as GitHub tokens, npm publishing tokens, cloud provider credentials, CI/CD secrets, SSH keys, and API keys. TeamPCP pioneered this at scale beginning in September 2025 with the original Shai-Hulud worm. Its defining innovation was cascading credential extraction: compromise one trusted tool, harvest the credentials it holds, and use those credentials to compromise the next tool in the dependency chain. The Trivy vulnerability scanner compromise yielded CI/CD runner secrets. Those secrets enabled the KICS compromise . KICS yielded additional cloud credentials. Each link in the chain generated a broader set of privileged access. By May, TeamPCP had refined this into the Mini Shai-Hulud variant, which introduced two capabilities that made the generation layer dramatically more efficient: Wormable propagation : The malware queries the npm registry for every package the compromised identity can publish, and republishes itself across all of them automatically. CI/CD pipeline hijack via OpenID Connect (OIDC) token extraction : Rather than stealing static credentials, Mini Shai-Hulud requests short-lived OIDC tokens through GitHub Actions, enabling it to publish packages with valid cryptographic provenance. In the Miasma supply chain campaign, this generation layer operated through a Red Hat employee’s compromised GitHub account. The worm’s payload swept the infected environment for: GitHub tokens and personal access tokens npm publishing tokens AWS, GCP, and Azure cloud credentials HashiCorp Vault tokens Kubernetes service account tokens SSH private keys Docker registry credentials GPG keys .env files The June variant added dedicated collectors for GCP and Azure cloud identities, going beyond secret extraction to enumerate all cloud access the infected machine holds. Every machine that ran npm install against a compromised @redhat-cloud-services package version became a credential generation node. Layer 2: Distribution The second layer is the marketplace. Stolen credentials flow from the generation layer into underground markets, infostealer log aggregators, and access brokering services, where they become available to any buyer. The Miasma supply chain-attack timeline makes this layer visible in a way previous campaigns did not. Whiteintel detected the Red Hat employee’s GitHub credential and session cookie in infostealer logs on April 13. That credential was not generated by a targeted supply chain attack against Red Hat; a commodity infostealer harvested it, one of 13.2 million infostealer infections that SpyCloud's 2025 Identity Exposure Report documented as producing an average of 50 credentials per infection. The credential entered the distribution layer as one data point among billions: SpyCloud recaptured 5.3 billion credential pairs, 18.1 million exposed API keys and tokens, and 8.6 billion stolen session cookies from criminal underground monitoring in 2025 alone. For seven weeks, the credential sat in the distribution layer before someone acted on it. That dwell time is the systemic gap that the Developer Credential Economy exploits. Organizations that do not monitor underground markets for exposed developer credentials are operating on the assumption that the generation-to-weaponization pipeline does not exist, or that it operates too slowly to matter. Miasma demonstrates that even a seven-week window, which is long by underground market standards, is more than sufficient for weaponization. The distribution layer was further amplified on May 12, when TeamPCP published the complete Mini Shai-Hulud source code on GitHub under an MIT License with the message “Shai-Hulud: Open Sourcing The Carnage.” The release included CI cache-poisoning scripts, the OIDC token extractor, and the credential stealer with its propagation logic. This is the supply chain equivalent of publishing a working exploit framework: the tooling itself became a distribution channel, lowering the barrier to entry for any operator who wants to run a structurally identical campaign. Layer 3: Weaponization The third layer is operational use. Actors with distinct motivations acquire credentials from the distribution layer and weaponize them against specific targets. In March, the RSO team documented at least three distinct actors operating from the same credential pool : TeamPCP harvested at scale: Sapphire Sleet/UNC1069 (DPRK-nexus) operationalized stolen npm tokens for financial gain through the Axios compromise and LAPSUS$ exploited compromised Tailscale VPN credentials from the LiteLLM breach for data theft from Mercor AI. The same credential ecosystem fed all three. Miasma’s weaponization layer continues to evolve, but the trajectory across its three waves demonstrates the pattern: Wave 1 (June 1) used the stolen R
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The Miasma campaign is a sophisticated supply chain attack that used a stolen Red Hat employee’s GitHub credential and session cookie, which were exposed in infostealer logs and underground markets for approximately seven weeks before being weaponized. The attack involved a self-propagating npm worm derived from Mini Shai-Hulud, which compromised 89+ npm packages across three waves in June 2026, affecting major organizations including Red Hat, Vapi.ai, and Microsoft Azure. The worm automatically republished itself across all packages the compromised identity could publish and used short-lived OpenID Connect tokens to produce malicious packages with valid SLSA Build Level 3 provenance attestations, defeating the highest supply chain integrity verification. The campaign also introduced persistence files targeting AI coding assistants such as Claude Code, Cursor, Gemini CLI, and VS Code, thereby expanding the attack vector to developers' local environments. The attack is part of a broader emerging threat model called the Developer Credential Economy, which consists of three layers: credential generation (harvesting developer tokens and secrets), distribution (underground markets and infostealer logs), and weaponization (using stolen credentials for cascading supply chain compromises). The public release of the Mini Shai-Hulud source code further lowers the barrier for replication of such attacks. Traditional endpoint detection and response (EDR) tools are insufficient to detect these attacks due to lack of visibility into ephemeral CI/CD environments where credential theft and weaponization occur.
Potential Impact
The Miasma campaign compromised critical open-source supply chain infrastructure by injecting malicious code into trusted npm packages used by thousands of developers and organizations, including Red Hat and Microsoft Azure. The attack bypassed advanced supply chain integrity protections by using valid cryptographic provenance attestations, undermining trust in software supply chains. It expanded the attack surface to developers' local environments by targeting AI coding assistants, potentially enabling further credential theft and persistence. The campaign demonstrates how stolen developer credentials can be weaponized to cause widespread cascading supply chain compromises, affecting software integrity and potentially enabling data theft, unauthorized code execution, and further downstream attacks.
Defensive Guidance
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Organizations should treat developer credentials as critical control-plane infrastructure and implement a phased Continuous Threat Exposure Management (CTEM) approach. This includes hardening credential generation processes, actively neutralizing harvested secrets in real time, and enforcing human-gated publishing controls to prevent unauthorized package publication. Monitoring underground markets for exposed developer credentials is recommended to reduce dwell time between credential theft and weaponization. Traditional endpoint detection tools alone are insufficient; enhanced visibility into CI/CD environments and credential usage is necessary to detect and prevent such supply chain attacks.
Technical Details
- Article Source
- {"url":"https://www.tenable.com/blog/what-the-miasma-campaign-reveals-about-the-new-supply-chain-threat-model-and-the-underground","fetched":true,"fetchedAt":"2026-06-23T13:03:36.621Z","wordCount":5125}
- Classification
- {"confidence":0.65,"severitySource":"default","classifier":"rss-v2"}
Threat ID: 6a3a8428eed863c81e03f881
Added to database: 06/23/2026, 13:03:36 UTC
Last enriched: 07/15/2026, 16:47:29 UTC
Last updated: 08/07/2026, 00:47:23 UTC
Views: 195
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.