Miasma Supply Chain Attack Compromises Red Hat npm Packages with Credential-Stealing Worm
A new supply chain attack, dubbed Miasma, has compromised Red Hat npm packages, utilizing a self-propagating worm to steal credentials and secrets from developer machines. The attack, leveraging techniques similar to the Mini Shai-Hulud campaign, involves obfuscated preinstall hooks that exfiltrate sensitive data like GitHub Actions secrets and cloud credentials. The involvement of the cybercrime group TeamPCP, who have released the attack tools, complicates attribution and increases the risk of similar attacks.
The Miasma attack campaign began with the compromise of Red Hat’s npm packages, specifically the @redhat-cloud-services suite. The core of the attack lies in a malicious preinstall hook designed to harvest sensitive information from developer environments, including GitHub Actions secrets, npm tokens, Kubernetes and Vault credentials, and SSH keys. This data is then encrypted and exfiltrated via API calls, initially to api.anthropic[.]com:443/v1/api and as a fallback through GitHub. The threat actors are actively attempting to weaponize this stolen data to further compromise the software supply chain. Notably, the malware exhibits a deliberate avoidance of execution on Russian-language systems, a tactic previously observed in GlassWorm campaigns. The sophistication of the attack includes techniques like enumerating repositories a token can write to, leveraging GraphQL to read action files, and creating signed commits through Sigstore, all designed to seamlessly integrate the malicious code into the affected projects. Recent analysis reveals the addition of collectors for GCP and Azure identities, indicating a shift towards broader cloud access exploitation.