Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign
2026-06-04T02:52:17Z•617139165321dfebbc6765ac5160ba8247c94937343b334b5a61694e6b5a924c
CI/CDcredential-theftcryptojackingdependency-confusionlateral-movementlinux-intrusionnpmpersistenceransomwaresupply-chainthreat-intelligencetyposquattingworm-like-propagation
What happened
Microsoft Security Blog highlights multiple high-impact threats targeting developer and enterprise environments. A large-scale npm supply-chain campaign ("Miasma") compromised over 90 versions of @redhat-cloud-services packages to steal GitHub, cloud, and local credentials and propagate by republishing trusted packages; related reports describe 33 malicious npm packages exploiting dependency confusion and numerous typosquatted packages targeting CI/CD and cloud secrets. Other notable incidents include a cryptojacking campaign abusing SEO poisoning and ScreenConnect, The Gentlemen self‑propagat
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- microsoft_security_blog
- Record identifier
- 617139165321dfebbc6765ac5160ba8247c94937343b334b5a61694e6b5a924c
- Enrichment time
- 2026-06-04T02:52:17Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.