Over 30 npm packages under Red Hat's '@redhat-cloud-services' namespace were compromised in a supply-chain attack, distributing a new variant of the Shai-Hulud malware called 'Miasma.' The malware targets sensitive developer credentials and secrets, affecting packages with approximately 117,000 weekly downloads.

• 01The compromised npm packages were found to contain a malicious preinstall script that executed a credential-stealing payload.
• 02Attackers allegedly accessed a Red Hat employee's GitHub account to publish backdoored packages directly to the npm registry.
• 03Red Hat has removed the affected packages and stated that the compromise was limited to internal development tooling.
• 04Organizations using the affected packages are advised to immediately rotate all credentials and secrets.
• 05The Miasma malware variant retains similar functionality to the Mini Shai-Hulud malware but features enhanced obfuscation and data theft capabilities.

Organizations using the compromised packages may face significant security risks due to credential theft.