# Miasma: Supply Chain Attack Targeting RedHat npm Packages

Compromised Red Hat employee GitHub account pushed orphan commits with OIDC-token workflows, publishing 32+ malicious @redhat-cloud-services npm packages that harvest cloud credentials.

- Payout: Real-world hack
- Severity: critical
- Program: Red Hat
- Credited: Wiz Research
- Disclosed: 2026-06-01
- Write-up quality: 8/10
- Original: https://www.wiz.io/blog/miasma-supply-chain-attack-targeting-redhat-npm-packages
- Library page: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-miasma-supply-chain-attack-targeting-redhat-npm-packages
- Tags: domain:oss impact:data-leak impact:internal-access kind:incident platform:threat-intel sev:critical tech:ci-cd tech:github-actions tech:nodejs tech:oidc technique:source-review vuln:secrets-leak

**Target:** npm packages under @redhat-cloud-services namespace and GitHub Actions OIDC publishing pipeline
**Root cause:** A Red Hat employee's GitHub account was compromised and used to push malicious orphan commits directly to RedHatInsights repos, bypassing code review. The injected workflow triggered on any branch push, requested a GitHub OIDC id-token, and ran an obfuscated _index.js that published packages with valid SLSA provenance.
**Steps:**
1. Compromise a Red Hat employee GitHub account with push access to RedHatInsights repos
2. Push orphan commits to branches like `oidc-61fff775` in frontend-components, javascript-clients, platform-frontend-ai-toolkit
3. Commit adds `.github/workflows/release.yml` with `on: push: branches: ['*']` and `permissions: id-token: write`
4. Workflow runs `bun run _index.js` with env `OIDC_PACKAGES` listing target packages
5. Payload requests OIDC token and publishes malicious versions with valid SLSA provenance
6. Malicious versions add `preinstall` script invoking obfuscated index.js using eval() and ROT decoding
7. Payload collects GitHub tokens, SSH keys, cloud credentials, and enumerates GCP/Azure identities
**How found:** Wiz Research compared published npm package contents against corresponding source repositories and found unauthorized modifications across 32 releases; traced back to orphan commits and injected OIDC workflows in RedHatInsights repos.
**Exploitation:** Attacker used the hijacked account to inject a minimal GitHub Actions workflow that fires on any branch push, obtains an OIDC identity token for npm publishing, and executes an obfuscated payload. The payload publishes trojanized package versions carrying a preinstall hook that runs on every install, exfiltrating developer credentials and enumerating cloud identities (GCP/Azure). Each infection gets a uniquely encrypted payload to defeat hash-based IOCs.
**Escalation:** Two waves of commits (10:53 and 13:44 UTC) across three repos; later wave added binding.gyp-based execution during install; expanded collectors from secret theft to full cloud identity enumeration, enabling pivot into victim cloud environments.
**Insight:** Orphan commits pushed directly to a repo bypass PR review entirely — audit for commits not reachable from main and for workflows with `on: push: branches: ['*']` plus `id-token: write`, since OIDC publishing yields valid SLSA provenance that defeats signature-based trust.