Preinstall to persistence: Inside the Red Hat npm Miasma credential-stealing campaign

Microsoft describes the “Miasma” npm supply‑chain campaign that compromised over 90 versions of @redhat-cloud-services packages to silently preinstall credential‑stealing malware into developer and CI/CD environments. The malicious code harvests GitHub and cloud credentials and local secrets, achieves persistence, and propagates like a worm by republishing or poisoning trusted packages so downstream projects install the backdoor. Impact includes widespread exposure of CI/CD tokens, cloud credentials, and developer machines; recommended mitigations include removing/replacing infected packages,—