# Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages

DevFeed: [Miasma supply chain attack: malicious code found in @redhat-cloud-services npm packages](<https://devfeed.tech/articles/miasma-supply-chain-attack-malicious-code-found-in-redhat-cloud-services-npm-packages-8014.md>)

Original publisher: [Read original article](<https://snyk.io/blog/miasma-supply-chain-attack-malicious-code-redhat-cloud-services-npm-packages/>)

Author: Brian Clark

Published: 2026-06-01T00:00:00Z

Content type: article

Language: en

Sources: [Blog RSS Feed | Snyk](<https://devfeed.tech/sources/blog-rss-feed-snyk.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [npm packages](<https://devfeed.tech/topics/npm-packages.md>), [redhat](<https://devfeed.tech/topics/redhat.md>), [incident](<https://devfeed.tech/topics/incident.md>), [GitHub](<https://devfeed.tech/topics/github.md>), [OpenID connect (OIDC)](<https://devfeed.tech/topics/oidc.md>), [API](<https://devfeed.tech/topics/api.md>), [React](<https://devfeed.tech/topics/react.md>), [Cloud](<https://devfeed.tech/topics/cloud.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [article](<https://devfeed.tech/tags/article.md>), [awareness](<https://devfeed.tech/tags/awareness.md>), [ci-cd](<https://devfeed.tech/tags/ci-cd.md>), [cloud-security](<https://devfeed.tech/tags/cloud-security.md>), [developer](<https://devfeed.tech/tags/developer.md>), [devops](<https://devfeed.tech/tags/devops.md>), [devsecops](<https://devfeed.tech/tags/devsecops.md>), [enablement](<https://devfeed.tech/tags/enablement.md>), [github](<https://devfeed.tech/tags/github.md>), [incident](<https://devfeed.tech/tags/incident.md>), [interest](<https://devfeed.tech/tags/interest.md>), [npm-packages](<https://devfeed.tech/tags/npm-packages.md>), [oidc](<https://devfeed.tech/tags/oidc.md>), [payload](<https://devfeed.tech/tags/payload.md>), [react](<https://devfeed.tech/tags/react.md>), [redhat](<https://devfeed.tech/tags/redhat.md>), [sbom](<https://devfeed.tech/tags/sbom.md>), [scm](<https://devfeed.tech/tags/scm.md>), [scope](<https://devfeed.tech/tags/scope.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [security](<https://devfeed.tech/tags/security.md>), [snyk-open-source](<https://devfeed.tech/tags/snyk-open-source.md>), [snyk-security-intel](<https://devfeed.tech/tags/snyk-security-intel.md>), [supply-chain](<https://devfeed.tech/tags/supply-chain.md>), [supply-chain-security](<https://devfeed.tech/tags/supply-chain-security.md>), [tech](<https://devfeed.tech/tags/tech.md>), [vulnerability-insights](<https://devfeed.tech/tags/vulnerability-insights.md>)

## AI overview

The Miasma supply chain attack compromised at least 32 @redhat-cloud-services npm package releases used by the Red Hat Hybrid Cloud Console. The malicious installation script steals developer and cloud credentials, attempts to spread through packages victims can publish, and may expose secrets on affected workstations and CI runners.

## Source excerpt

A supply chain worm dubbed Miasma has been found in dozens of @redhat-cloud-services npm releases. The malicious preinstall hook steals credentials, probes cloud identities, and can republish other packages.