Threats Tagged 'oidc workflow abuse'

Microsoft Threat Intelligence identified a large-scale npm supply chain attack involving 32 malicious packages under the @redhat-cloud-services scope. The attack originated from compromise of the RedHatInsights/javascript-clients CI/CD pipeline, allowing attackers to publish trojanized packages via legitimate GitHub Actions OIDC workflows with authentic provenance signatures. These malicious packages used npm preinstall hooks to execute a heavily obfuscated dropper that downloaded the Bun JavaScript runtime and launched payloads to steal credentials from multiple cloud and developer platforms. The malware harvested secrets from GitHub Actions runner memory, escalated privileges using passwordless sudo, exfiltrated data through GitHub infrastructure, and propagated by compromising additional maintainer packages with forged SLSA provenance. The campaign is marked by the identifier "Miasma: The Spreading Blight. " No patch or remediation guidance is currently provided by the vendor.