Miasma supply chain attack hijacks 32 Red Hat npm packages, stealing CI/CD credentials
On June 1 2026, researchers at Aikido discovered that 32 @redhat‑cloud‑services npm packages were backdoored with a credential‑stealing worm dubbed “Miasma”, a Shai‑Hulud variant. The malicious versions, published via compromised GitHub Actions OIDC tokens, have been downloaded over 100 k times, prompting immediate rotation of cloud and CI secrets.