Miasma — Red Hat npm Supply-Chain Credential Worm

Miasma ("The Spreading Blight") is a self-propagating npm supply-chain worm in the Shai-Hulud lineage. On 1 June 2026 it backdoored 32 packages (~96 versions) in the @redhat-cloud-services npm scope — roughly 116,991 weekly downloads — after an attacker hijacked a Red Hat maintainer's GitHub account and pushed orphan commits carrying valid OIDC/SLSA provenance. By 5 June, 57+ packages and 300+ malicious versions had been identified across the wider npm ecosystem.

The worm runs at install time, before any application code, through two mechanisms: a classic preinstall hook ("preinstall": "node index.js") and — in the second wave — "Phantom Gyp": a weaponized binding.gyp whose sources array embeds a node-gyp command-substitution that silently runs index.js during native-module compilation, bypassing detections that only watch npm lifecycle hooks. The dropper (a ~4 MB Caesar-cipher/AES-128-GCM/obfuscator.io payload) downloads a legitimate Bun v1.3.13 binary to /tmp/b-<random>/bun and harvests credentials for GitHub, npm, AWS, Azure, GCP, HashiCorp Vault and Kubernetes from environment variables, cloud metadata services (IMDSv2 169.254.169.254, ECS 169.254.170.2, Vault 127.0.0.1:8200) and on-disk secret files. When it finds publish-capable npm tokens it re-publishes infected packages to propagate. It also plants AI-coding-agent persistence (~/.claude/settings.json SessionStart hooks, .vscode/tasks.json folderOpen tasks) that fire a harvester when a repo is opened in Claude Code / Cursor / VS Code / Gemini CLI, and crossed into PyPI (37 malicious wheels / 19 packages using .pth startup hooks).

Defender priority: This worm executes during dependency install in CI/CD and dev workstations — not at app runtime. The single highest-value detection is node / npm / node-gyp spawning a shell, bun, or a child that touches cloud-metadata IPs or ~/.npmrc/~/.aws/kube/Vault paths during an install. Treat any host that installed an affected @redhat-cloud-services version since 1 June 2026 as credential-compromised: rotate all npm, GitHub, and cloud tokens reachable from that host/runner.

Provenance note: api.anthropic.com/v1/api appears as a spoofed / dormant exfil channel (Microsoft: noop:true, disabled). It is a legitimate Anthropic host — do not blocklist it. It is carried only as an enrich/context indicator. GitHub, npm registry, Sigstore, and cloud-metadata endpoints are all legitimate services abused as living-off-the-land exfil; detection is behavioral, not domain-blocking.

Hunt hypotheses (fidelity-ordered)

1. H1 (high): A node/npm/node-gyp process spawns bun (or a binary under /tmp/b-*, /var/folders/*/b-*) during dependency install — the Miasma runtime drop. T1059 / T1195.002
2. H2 (high): A package-manager install tree makes outbound connections to cloud metadata IPs (169.254.169.254, 169.254.170.2) or to local Vault (127.0.0.1:8200) — credential harvest during install. T1552.005 / T1552.001
3. H3 (high): binding.gyp written/seen on disk whose contents embed a node-gyp command-substitution (<!(node …)) — the Phantom Gyp signature. T1195.002
4. H4 (med): An install-time child process reads ~/.npmrc, ~/.aws/credentials, kubeconfig, ~/.config/gcloud, SSH keys, or ~/.claude.json. T1552.001
5. H5 (med): Creation/modification of AI-agent persistence: ~/.claude/settings.json (SessionStart hook) or .vscode/tasks.json (folderOpen) shortly after a clone/install. T1546
6. H6 (med): An install-time process runs gh auth token, npm whoami/npm token, or queries registry.npmjs.org/-/npm/v1/tokens — token theft / republish staging. T1552.004 / T1195.002
7. H7 (med): Sudoers tamper on a CI runner: write to /mnt/runner or a sudoers file containing NOPASSWD:ALL for runner. T1548.003
8. H8 (low): EDR-fingerprinting file reads (/opt/CrowdStrike, /Library/CS/falcon, /opt/sentinelone) by an install-time child. T1518.001

Attack chain

Every atomic IOC below traces to a cited Tier-1 source (§18). Per-infection re-encryption means file hashes are low-durability — favor the behavioral indicators (Phantom Gyp signature, bun-from-node, metadata-IP touches). Package versions and the binding.gyp/loader hashes are the most reliable atomic anchors.

npm registry / package side

• Audit your lockfiles (package-lock.json, yarn.lock, pnpm-lock.yaml) for any resolved @redhat-cloud-services/* version published on/after 1 Jun 2026; cross-check against §4.
• npm org: review publish events and token creation for the past 30 days; revoke all granular + legacy automation tokens and require 2FA/trusted-publishing.
• Grep extracted node_modules for the Phantom Gyp signature and markers: <!(node index.js, Miasma: The Spreading Blight, IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner.
• Flag any binding.gyp whose sources array contains a <!(...) command-substitution invoking node/sh — legitimate gyp sources are file names, not commands.

GitHub / SCM side

• Search org for newly created repos with description Miasma: The Spreading Blight or files at results/<timestamp>-<counter>.json / .github/setup.js / injected codeql.yml on branches prefixed oidc- or chore/add-codeql-static-analysis.
• Review Actions runs that used id-token: write in the window; rotate any OIDC-derived cloud roles.

Cloud control plane

• AWS CloudTrail: GetCallerIdentity / Secrets Manager / SSM calls from a build identity immediately after an npm install, especially from new IPs/UA python-requests/2.31.0.
• Azure sign-in logs / GCP audit: token use originating from CI egress IPs shortly after package install.

These are off-endpoint checks the EDR cannot see. Run them in parallel with the CQL hunts (§8) and treat any correlated hit as confirmed compromise.

// HUNT: Miasma runtime drop — bun spawned by node/npm/node-gyp
// MITRE: T1195.002, T1059.007 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 (Linux/macOS/Windows)
// FALSE POSITIVES: legitimate Bun-based projects that run bun from node tooling
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ImageFileName=/(\/|\\)(bun|bun\.exe)$/i
| ParentBaseFileName=/^(node|npm|npx|node-gyp|sh|bash|zsh)$/i
| table([ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, SHA256HashData, aid], limit=200)

// HUNT: Miasma credential harvest — metadata/Vault from install runtime
// MITRE: T1552.005, T1552.001 | CONF: high  FP: medium  COST: low
// REQUIRES: NetworkConnectIP4
// FALSE POSITIVES: cloud SDKs / IaC agents legitimately querying IMDS
// TUNING: exclude approved IaC hosts (terraform/ansible runners) by aid or ComputerName
#event_simpleName=NetworkConnectIP4
| ContextBaseFileName=/^(node|bun|npm|node-gyp|python|python3)$/i
| in(RemoteAddressIP4, values=["169.254.169.254","169.254.170.2","127.0.0.1"])
| (RemoteAddressIP4!="127.0.0.1" OR RemotePort=8200)
| table([ComputerName, UserName, ContextBaseFileName, RemoteAddressIP4, RemotePort, aid], limit=200)

// HUNT: Phantom Gyp — node-gyp build executes node/shell child (binding.gyp abuse)
// MITRE: T1195.002, T1059 | CONF: high  FP: medium  COST: low
// REQUIRES: ProcessRollup2
// FALSE POSITIVES: legit native-module compiles that invoke node during gyp
// TUNING: combine with Q1/Q2 hit on same aid; exclude known native-build images
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(node-gyp|gyp|node)$/i
| CommandLine=/(index\.js|\bsh\b|\bbash\b|-e\s+|child_process)/i
| ImageFileName=/(\/|\\)(node|sh|bash|zsh|bun)$/i
| table([ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, aid], limit=200)

// HUNT: Miasma secret-file access by install-time runtime
// MITRE: T1552.001 | CONF: medium  FP: medium  COST: medium
// REQUIRES: FileOpenInfo / FileOpen (file-access telemetry enabled)
// FALSE POSITIVES: legit CLI config reads (aws/gcloud/kubectl)
// TUNING: require ContextBaseFileName in node/bun set AND a high-value path
#event_simpleName=/FileOpen|FileOpenInfo/
| ContextBaseFileName=/^(node|bun|npm|python|python3)$/i
| TargetFileName=/(\.npmrc|\.aws(\/|\\)credentials|kubeconfig|gcloud(\/|\\)|\.ssh(\/|\\)id_|\.claude\.json|VAULT_TOKEN)/i
| table([ComputerName, UserName, ContextBaseFileName, TargetFileName, aid], limit=200)

// HUNT: Miasma persistence — AI-agent hook / .pth written by install runtime
// MITRE: T1546 | CONF: high  FP: medium  COST: low
// REQUIRES: FileWritten / NewExecutableWritten
// FALSE POSITIVES: user-driven editor/agent config saves
// TUNING: require writer ContextBaseFileName in node/bun/npm; exclude IDE binaries
#event_simpleName=/FileWritten|NewScriptWritten/
| ContextBaseFileName=/^(node|bun|npm|python|python3)$/i
| TargetFileName=/(\.claude(\/|\\)settings\.json|\.vscode(\/|\\)tasks\.json|site-packages(\/|\\).*\.pth)$/i
| table([ComputerName, UserName, ContextBaseFileName, TargetFileName, aid], limit=200)

// HUNT: Miasma token theft / republish staging
// MITRE: T1552.004, T1528, T1195.002 | CONF: medium  FP: medium  COST: low
// REQUIRES: ProcessRollup2 (command line visibility)
// FALSE POSITIVES: CI steps that legitimately run gh/npm auth
// TUNING: require ParentBaseFileName in node/npm/node-gyp/sh install context
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| ParentBaseFileName=/^(node|npm|npx|node-gyp|bun|sh|bash)$/i
| CommandLine=/(gh\s+auth\s+token|npm\s+token|npm\s+whoami|registry\.npmjs\.org\/-\/npm\/v1\/tokens)/i
| table([ComputerName, UserName, ParentBaseFileName, ImageFileName, CommandLine, aid], limit=200)

// HUNT: Miasma privilege escalation — sudoers NOPASSWD write on runner
// MITRE: T1548.003 | CONF: high  FP: low  COST: low
// REQUIRES: ProcessRollup2 OR FileWritten
// FALSE POSITIVES: rare; legit sudoers automation should be allowlisted
#event_simpleName=/ProcessRollup2|SyntheticProcessRollup2/
| CommandLine=/(NOPASSWD:\s*ALL|(\/|\\)mnt(\/|\\)runner|(\/|\\)etc(\/|\\)sudoers)/i
| CommandLine=/(echo|tee|sed|cat|printf|mount)/i
| table([ComputerName, UserName, ImageFileName, CommandLine, aid], limit=200)

// HUNT: Miasma security-software discovery
// MITRE: T1518.001 | CONF: medium  FP: medium  COST: medium
// REQUIRES: FileOpen/FileOpenInfo OR ProcessRollup2
// FALSE POSITIVES: inventory/asset agents enumerating security tooling
// TUNING: require ContextBaseFileName node/bun and exclude asset-mgmt agents
#event_simpleName=/FileOpen|FileOpenInfo/
| ContextBaseFileName=/^(node|bun|python|python3)$/i
| TargetFileName=/(\/opt\/CrowdStrike|\/Library\/CS\/falcon|\/opt\/sentinelone|\/opt\/carbonblack)/i
| table([ComputerName, UserName, ContextBaseFileName, TargetFileName, aid], limit=200)

Tuning order: Q1 and Q7 are near-zero-FP — promote first. Q2/Q3 fire on credential harvest and Phantom Gyp; pair them on the same aid for a high-confidence install-time compromise. Q4/Q5/Q6/Q8 are hunt-grade pivots — investigate hits, don't alert blindly.

Promote Q1 and Q7 to blocking Custom IOAs on CI runner host groups first (lowest FP, highest impact). Run Q2/Q5 as Detect-only for 1–2 weeks to baseline before any block.

One-click blocks for Falcon IOC Management and your detection backlog. Hashes are sourced (§4/§18) but low-durability (per-infection re-encryption) — prefer the behavioral signatures.

type,value,action,severity,expiration,description,tags
sha256,ef641e956f91d501b748085996303c96a64d67f63bfeef0dda175e5aa19cca90,detect,critical,2026-12-21,Miasma Phantom Gyp binding.gyp,campaign:Miasma
sha256,c2a60face766f69f82c972375f35f8ebaa45d6c464176974e631d9a78d6bea0a,detect,critical,2026-12-21,Miasma stage-1 loader,campaign:Miasma
sha256,396cac9e457ec54ff6d3f6311cb5cc1da8054d019ce3ffa1de5741506c7a4ea4,detect,high,2026-12-21,Miasma payload remediations-client,campaign:Miasma
sha256,d8d170af3de17bb9b217c52aaaffdf9395f35ef015a57ef676e406c121e5e223,detect,high,2026-12-21,Miasma payload advisor-components,campaign:Miasma
sha256,f0641e053e81f0d01fa46db35a83e0a34494886503086866d956d14e81fd3e1c,detect,high,2026-12-21,Miasma payload hcc-kessel-mcp,campaign:Miasma
sha256,d5a97614d5319ce9c8e01fa0b4eb06fb5b9e54fa13b23d718174a1546444123b,detect,high,2026-12-21,Miasma payload fe-components-testing,campaign:Miasma
sha256,f88258e21592084a2f93a572ade8f9b91c0cd0e242f5cf6121ed7bad0f7bdd1f,detect,high,2026-12-21,Miasma payload notifications,campaign:Miasma
sha256,25e121e3b7d300c0d0075b33e5eca39a3e6a659fb9cfee52b70ef71686628f1b,detect,high,2026-12-21,Miasma payload chrome,campaign:Miasma
md5,8cd0b0fbd4232face584c66d9754bf1e,detect,high,2026-12-21,Miasma stage-1 loader (MD5),campaign:Miasma

# Phantom Gyp — weaponized binding.gyp sources array
"sources": ["<!(node index.js > /dev/null 2>&1 && echo stub.c)"]
# v1-wave preinstall hook
"preinstall": "node index.js"
# Dead-drop / tripwire string markers
Miasma: The Spreading Blight
IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner
# Dropped Bun runtime paths
/tmp/b-<rand>/bun
/var/folders/<...>/b-<rand>/bun
bun.exe
/tmp/p<base36>.js
# Behavioral chains
node|npm|node-gyp  ->  bun (or /tmp/b-*/bun)
node|bun  ->  169.254.169.254 | 169.254.170.2 | 127.0.0.1:8200
node|bun  writes  ~/.claude/settings.json | .vscode/tasks.json | site-packages/*.pth

# @redhat-cloud-services scope — published on/after 2026-06-01
@redhat-cloud-services/chrome@2.3.1 @2.3.2 @2.3.4
@redhat-cloud-services/frontend-components@7.7.2 @7.7.3 @7.7.5
@redhat-cloud-services/types@3.6.1 @3.6.2 @3.6.4
@redhat-cloud-services/rbac-client@9.0.3 @9.0.4 @9.0.6
@redhat-cloud-services/rule-components@4.7.2 @4.7.3
@redhat-cloud-services/remediations-client@4.0.4 @4.0.5 @4.0.7
@redhat-cloud-services/insights-client@4.0.4 @4.0.5 @4.0.7
@redhat-cloud-services/host-inventory-client@5.0.3 @5.0.4 @5.0.6
@redhat-cloud-services/javascript-clients-shared@2.0.8 @2.0.9 @2.0.11
@redhat-cloud-services/notifications@6.9.3
@redhat-cloud-services/frontend-components-config-utilities@4.11.3
@redhat-cloud-services/tsc-transform-imports@1.2.2 @1.2.4
# Second wave (2026-06-03/04)
@vapi-ai/server-sdk
ai-sdk-ollama
# Action: pin to last-known-good PRE-2026-06-01 version; rotate all reachable secrets

# Legitimate services abused as LOLBin exfil/delivery — DO NOT blocklist
api.anthropic.com/v1/api        # dormant noop:true spoof channel (legit Anthropic host)
github.com/oven-sh/bun/releases/download/bun-v1.3.13/   # legit Bun release abused
registry.npmjs.org/-/npm/v1/tokens   # token-theft endpoint (legit registry)
fulcio.sigstore.dev / rekor.sigstore.dev   # provenance abuse (legit)
# Spoofed User-Agents (enrich/correlate only)
python-requests/2.31.0
google-api-nodejs-client/7.0.0
# Mend advisory: MSC-2026-6085

MITRE mitigations cited as the why; the what is anchored to npm/OpenSSF Secure Supply Chain guidance, CIS Software Supply Chain Security, and cloud-provider IMDSv2 hardening (AWS/Azure/GCP) — see §13 for deployable form.

1 · Harden CI installs (disable scripts + pin)

# .npmrc committed at repo root (and in CI image)
ignore-scripts=true
audit-signatures=true
# CI install step
npm ci --ignore-scripts
# When a dep genuinely needs a native build, run it explicitly + reviewed:
#   npm rebuild <allowlisted-pkg>

2 · Audit lockfiles for affected versions (run on every repo)

#!/usr/bin/env bash
# Flag any resolved @redhat-cloud-services version present in lockfiles.
set -euo pipefail
grep -REn '@redhat-cloud-services/' \
  --include='package-lock.json' --include='yarn.lock' --include='pnpm-lock.yaml' . \
  | grep -Ei 'chrome@2\.3\.|frontend-components@7\.7\.|types@3\.6\.|rbac-client@9\.0\.|rule-components@4\.7\.|remediations-client@4\.0\.|insights-client@4\.0\.|host-inventory-client@5\.0\.|notifications@6\.9\.3|config-utilities@4\.11\.3|tsc-transform-imports@1\.2\.' \
  && echo "[!] Affected Miasma version(s) found — pin to pre-2026-06-01 and rotate secrets" \
  || echo "[ok] No known-affected versions in lockfiles"

3 · Scan extracted node_modules for Phantom Gyp / markers

#!/usr/bin/env bash
# Detect weaponized binding.gyp and dead-drop markers in installed trees.
set -euo pipefail
ROOT="${1:-.}"
grep -REn --include='binding.gyp' '<!\(.*node ' "$ROOT" \
  && echo "[!] Phantom Gyp command-substitution in binding.gyp"
grep -REn -e 'Miasma: The Spreading Blight' \
          -e 'IfYouInvalidateThisTokenItWillNukeTheComputerOfTheOwner' \
          -e '"preinstall": *"node index.js"' "$ROOT" \
  && echo "[!] Miasma marker found" || echo "[ok] clean"

4 · Enforce IMDSv2 hop-limit on AWS build hosts

# Require IMDSv2 and block container hop to metadata (run per instance / in launch template)
aws ec2 modify-instance-metadata-options \
  --instance-id i-EXAMPLE \
  --http-tokens required \
  --http-put-response-hop-limit 1 \
  --http-endpoint enabled

Assume full credential compromise for any identity reachable from a host that installed an affected version since 1 Jun 2026. Token rotation is non-optional — the worm's entire purpose is exfil + republish, so stolen publish tokens enable re-propagation even after you clean the endpoint.

Known gaps: Exfil-over-GitHub and package republish are not endpoint-visible — covered only by the native npm/GitHub/cloud audit hunts in §7. Ephemeral CI runners without a Falcon sensor are the largest blind spot; prioritize sensor coverage on build infrastructure. Q4/Q5/Q8 depend on file-access telemetry being enabled in the prevention policy. Validation: all gates in §11 must pass before promoting Q1/Q7 to blocking IOAs.

Generated 2026-06-21 · HuntPack v0.1 · Defensive hunt/detection/hardening content only.