A sophisticated supply chain attack campaign, dubbed Miasma, has targeted multiple organizations by exploiting stolen developer credentials, leading to the compromise of numerous software packages. The campaign, which began on June 1, affected packages within Red Hat, Vapi.ai, and Microsoft Azure repositories. Researchers observed that the malicious packages generated by Miasma included valid Supply Chain Levels for Software Artifacts (SLSA) Build Level 3 provenance attestations, a high level of integrity verification.
The root cause of the compromise has been identified as a stolen developer credential, specifically a GitHub credential and session cookie belonging to a Red Hat employee. This credential was detected in underground markets on April 13 and again on May 15, indicating it remained available for approximately seven weeks before being weaponized by attackers on June 1. This pattern highlights an emerging threat model described by researchers as the "Developer Credential Economy," characterized by the theft and subsequent sale of privileged developer access.
The Miasma campaign itself is derived from a previously open-sourced tool called Mini Shai-Hulud, released by TeamPCP on May 12. The public availability of this toolchain allows for the replication of similar supply chain attacks. The Miasma worm operates by compromising existing packages and then propagating itself to others within the same registry.
The initial wave of the Miasma campaign, occurring between June 1 and June 5, compromised 32 official npm packages under the @redhat-cloud-services namespace. These packages, which had an estimated 80,000 to 117,000 weekly downloads, delivered a payload designed to harvest credentials. The attack escalated through three distinct waves, ultimately leading to GitHub disabling 73 repositories across four Microsoft organizations.
A significant escalation occurred during the third wave of the Miasma campaign on June 5, when attackers introduced persistence files targeting AI coding assistants. This expansion of the attack surface includes tools such as Claude Code, Cursor, Gemini CLI, and VS Code, moving beyond package registries to affect the developer's local environment.
The Miasma campaign's success in generating malicious packages with valid SLSA provenance attestations is particularly concerning. This capability is achieved through the hijacking of CI/CD pipelines, specifically by extracting short-lived OpenID Connect (OIDC) tokens via GitHub Actions, rather than relying solely on static credentials.
The Developer Credential Economy, as described by researchers, operates in three layers: credential generation, distribution, and weaponization. In the Miasma campaign, TeamPCP is identified as being involved in the generation layer, harvesting a broad range of credentials including GitHub tokens, cloud credentials, CI/CD secrets, SSH keys, and .env files from infected environments.
The distribution layer involves underground markets and infostealer aggregators where stolen credentials are sold. The seven-week period between the credential's detection in infostealer logs and its weaponization exemplifies this layer.
The weaponization layer involves various threat actors who utilize the compromised credentials for their own objectives, which can include data theft or further supply chain compromises. The Miasma campaign itself is seen as an example of this, with each wave potentially generating new credentials to fuel subsequent attacks.
Researchers emphasize that traditional execution-layer detection methods, such as Endpoint Detection and Response (EDR) tools, are insufficient against these supply chain threats due to their lack of visibility into ephemeral CI/CD environments where credential theft and weaponization often occur. Organizations are advised to treat developer credentials as critical infrastructure and implement a phased Continuous Threat Exposure Management (CTEM) approach, focusing on hardening credential generation, neutralizing harvested secrets, and enforcing human-gated publishing controls.
