{
  "Event": {
    "analysis": "1",
    "date": "2026-06-02",
    "extends_uuid": "",
    "info": "[Threat Intel] Preinstall to persistence: Inside the npm Miasma credential-stealing campaign",
    "protected": false,
    "publish_timestamp": "1780629609",
    "published": true,
    "threat_level_id": "2",
    "timestamp": "1780629609",
    "uuid": "a3c52e1d-66df-4660-9c0d-df262d3772d4",
    "Orgc": {
      "name": "Rectifyq",
      "uuid": "cd9bd516-61fa-476b-980f-2f8de03992d4"
    },
    "Tag": [
      {
        "colour": "#96f4f6",
        "local": false,
        "name": "misp-galaxy:producer=\"Microsoft\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffffff",
        "local": false,
        "name": "tlp:clear",
        "relationship_type": ""
      },
      {
        "colour": "#004646",
        "local": false,
        "name": "type:OSINT",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"none-from-src\"",
        "relationship_type": ""
      },
      {
        "colour": "#b94b1d",
        "local": false,
        "name": "rectifyq:mitre-att&ck=\"from-OTX\"",
        "relationship_type": ""
      },
      {
        "colour": "#d3f567",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"JavaScript - T1059.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#95f9b9",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Sudo and Sudo Caching - T1548.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#201172",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Dependencies and Development Tools - T1195.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#197fe5",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SAML Tokens - T1606.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#a92e1c",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Deobfuscate/Decode Files or Information - T1140\"",
        "relationship_type": ""
      },
      {
        "colour": "#e7d11f",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Private Keys - T1552.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#5780f7",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Default Accounts - T1078.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"SSH Authorized Keys - T1098.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#0c0051",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"File and Directory Discovery - T1083\"",
        "relationship_type": ""
      },
      {
        "colour": "#f95f85",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Credentials In Files - T1552.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exfiltration to Code Repository - T1567.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#83203e",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Account - T1136.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#6d779a",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Exploitation for Privilege Escalation - T1068\"",
        "relationship_type": ""
      },
      {
        "colour": "#e08bb2",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Obfuscated Files or Information - T1027\"",
        "relationship_type": ""
      },
      {
        "colour": "#d596aa",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Compromise Software Supply Chain - T1195.002\"",
        "relationship_type": ""
      },
      {
        "colour": "#a05856",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Data Destruction - T1485\"",
        "relationship_type": ""
      },
      {
        "colour": "#5300bd",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Application Access Token - T1550.001\"",
        "relationship_type": ""
      },
      {
        "colour": "#37c019",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Cloud Accounts - T1078.004\"",
        "relationship_type": ""
      },
      {
        "colour": "#3b4369",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Container API - T1552.007\"",
        "relationship_type": ""
      },
      {
        "colour": "#0088cc",
        "local": false,
        "name": "misp-galaxy:mitre-attack-pattern=\"Local Accounts - T1078.003\"",
        "relationship_type": ""
      },
      {
        "colour": "#49a260",
        "local": false,
        "name": "rectifyq:category=\"threat\"",
        "relationship_type": ""
      },
      {
        "colour": "#130049",
        "local": false,
        "name": "rectifyq:sub-category=\"campaign-analysis\"",
        "relationship_type": ""
      },
      {
        "colour": "#18005e",
        "local": false,
        "name": "rectifyq:topic=\"supply-chain\"",
        "relationship_type": ""
      },
      {
        "colour": "#1b0068",
        "local": false,
        "name": "rectifyq:topic=\"cloud\"",
        "relationship_type": ""
      },
      {
        "colour": "#ffd12e",
        "local": false,
        "name": "rectifyq:target=\"broad-based\"",
        "relationship_type": ""
      },
      {
        "colour": "#55acee",
        "local": false,
        "name": "rectifyq:MY-relevancy=\"potentially-relevant\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
        "relationship_type": ""
      },
      {
        "colour": "#626567",
        "local": false,
        "name": "rectifyq:no-samples-in=\"Tria.ge\"",
        "relationship_type": ""
      },
      {
        "colour": "#3800d9",
        "local": false,
        "name": "rectifyq:action-taken=\"VT-comment\"",
        "relationship_type": ""
      },
      {
        "colour": "#3d00e9",
        "local": false,
        "name": "rectifyq:action-taken=\"telegram\"",
        "relationship_type": ""
      }
    ],
    "Attribute": [
      {
        "category": "External analysis",
        "comment": "",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570810",
        "to_ids": false,
        "type": "link",
        "uuid": "acbaacce-5f44-420e-a908-b57d3aa56db8",
        "value": "https://www.microsoft.com/en-us/security/blog/2026/06/02/preinstall-persistence-inside-red-hat-npm-miasma-credential-stealing-campaign/"
      },
      {
        "category": "Other",
        "comment": "Description",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570810",
        "to_ids": false,
        "type": "text",
        "uuid": "44f91d9d-4fa9-45bc-9688-f3caa80b05a7",
        "value": "Microsoft Threat Intelligence discovered a large-scale npm supply chain attack compromising 32 malicious packages across over 90 versions under the @redhat-cloud-services scope. The compromise originated from the RedHatInsights/javascript-clients CI/CD pipeline, enabling attackers to publish trojanized packages through legitimate GitHub Actions OIDC workflows with authentic provenance signatures. The malicious packages executed a heavily obfuscated 4.29 MB dropper via npm preinstall hooks, which downloaded the Bun JavaScript runtime and launched payloads designed to harvest credentials from GitHub, npm, AWS, Azure, GCP, HashiCorp Vault, Kubernetes, and developer systems. The malware scraped GitHub Actions runner memory for secrets, escalated privileges using passwordless sudo, exfiltrated stolen data through GitHub infrastructure, and propagated by compromising additional maintainer packages with forged SLSA provenance. The campaign marker \"Miasma: The Spreading Blight\" was embedded throughout the malicious"
      },
      {
        "category": "Other",
        "comment": "Summary",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780570810",
        "to_ids": false,
        "type": "text",
        "uuid": "4f625363-40d3-4877-94c1-1b678f615d58",
        "value": "Name: Preinstall to persistence: Inside the npm Miasma credential-stealing campaign\nAuthor: AlienVault\nAdversary: \nTags: [\"slsa provenance forgery\", \"github actions\", \"supply chain attack\", \"oidc workflow abuse\"]\nTgtd countries: []\nMlwr families: []\nAttack_ids: [\"T1059.007\", \"T1548.003\", \"T1195.001\", \"T1606.002\", \"T1140\", \"T1552.004\", \"T1078.001\", \"T1098.004\", \"T1083\", \"T1552.001\", \"T1567.001\", \"T1136.003\", \"T1068\", \"T1027\", \"T1195.002\", \"T1485\", \"T1550.001\", \"T1078.004\", \"T1552.007\", \"T1078.003\"]\nIndustries: []"
      },
      {
        "category": "Payload delivery",
        "comment": "Index.js (from redhat-cloud-services/remediations-client) No sample in VT\r\nLast check:05/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780623456",
        "to_ids": true,
        "type": "sha256",
        "uuid": "67d85be7-e354-4531-8f26-f92516f36670",
        "value": "396cac9e457ec54ff6d3f6311cb5cc1da8054d019ce3ffa1de5741506c7a4ea4",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "index.js (from @redhat-cloud-services/frontend-components-advisor-components-3.8.2) No sample in VT\r\nLast check:05/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780623457",
        "to_ids": true,
        "type": "sha256",
        "uuid": "b48c839e-0190-4f41-815d-e341b66919e6",
        "value": "d8d170af3de17bb9b217c52aaaffdf9395f35ef015a57ef676e406c121e5e223",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "index.js (from @redhat-cloud-services/frontend-components-testing-1.2.4) No sample in VT\r\nLast check:05/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780623458",
        "to_ids": true,
        "type": "sha256",
        "uuid": "7656ac9a-3737-46b3-b4f0-e015085170ef",
        "value": "d5a97614d5319ce9c8e01fa0b4eb06fb5b9e54fa13b23d718174a1546444123b",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "index.js (from @redhat-cloud-services/hcc-kessel-mcp-0.3.4) No sample in VT\r\nLast check:05/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780623459",
        "to_ids": true,
        "type": "sha256",
        "uuid": "24c3c3d7-7e1f-42ef-840f-6dfce0173e83",
        "value": "f0641e053e81f0d01fa46db35a83e0a34494886503086866d956d14e81fd3e1c",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      },
      {
        "category": "Payload delivery",
        "comment": "index.js (from @redhat-cloud-services/frontend-components-notifications-6.9.3) No sample in VT\r\nLast check:05/06/2026",
        "deleted": false,
        "disable_correlation": false,
        "timestamp": "1780623460",
        "to_ids": true,
        "type": "sha256",
        "uuid": "d98ce017-9ffe-4dda-af75-e954c7ce6a87",
        "value": "f88258e21592084a2f93a572ade8f9b91c0cd0e242f5cf6121ed7bad0f7bdd1f",
        "Tag": [
          {
            "colour": "#260091",
            "local": false,
            "name": "rectifyq:ioc=\"enriched\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"VirusTotal\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
            "relationship_type": ""
          },
          {
            "colour": "#626567",
            "local": false,
            "name": "rectifyq:no-samples-in=\"Tria.ge\"",
            "relationship_type": ""
          }
        ]
      }
    ],
    "Object": [
      {
        "comment": "",
        "deleted": false,
        "description": "File object describing a file with meta-information",
        "meta-category": "file",
        "name": "file",
        "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215",
        "template_version": "25",
        "timestamp": "1780624061",
        "uuid": "512a5e0d-7f46-42bd-96ce-52eab9d9fbac",
        "Attribute": [
          {
            "category": "Payload delivery",
            "comment": "index.js (from @redhat-cloud-services/chrome-2.3.4)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "md5",
            "timestamp": "1780624061",
            "to_ids": true,
            "type": "md5",
            "uuid": "770868ca-1396-4f64-9b72-0509826c07fd",
            "value": "df7e515d054d01f6fe9eb64a1180f197",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              },
              {
                "colour": "#342294",
                "local": false,
                "name": "CommentAdded",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "index.js (from @redhat-cloud-services/chrome-2.3.4)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha1",
            "timestamp": "1780623455",
            "to_ids": true,
            "type": "sha1",
            "uuid": "edffd8e3-f242-4be2-9cce-23d4175ef072",
            "value": "de9a2ad348d64f2f0a2a29128f279f481679d3e1",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "index.js (from @redhat-cloud-services/chrome-2.3.4)",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "sha256",
            "timestamp": "1780623455",
            "to_ids": true,
            "type": "sha256",
            "uuid": "9a97677b-76c5-4ce3-bb14-ad07853482c9",
            "value": "25e121e3b7d300c0d0075b33e5eca39a3e6a659fb9cfee52b70ef71686628f1b",
            "Tag": [
              {
                "colour": "#260091",
                "local": false,
                "name": "rectifyq:ioc=\"enriched\"",
                "relationship_type": ""
              },
              {
                "colour": "#220085",
                "local": false,
                "name": "rectifyq:samples-found-in=\"VirusTotal\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"MalwareBazaar\"",
                "relationship_type": ""
              },
              {
                "colour": "#626567",
                "local": false,
                "name": "rectifyq:no-samples-in=\"Tria.ge\"",
                "relationship_type": ""
              }
            ]
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "ssdeep",
            "timestamp": "1780621795",
            "to_ids": true,
            "type": "ssdeep",
            "uuid": "b8c12f5c-3fed-4a89-ab83-9b89925e3f01",
            "value": "768:ALecRKIcmg6nPey4iCmbR1IAsoNBKRCKKZbP9d+Hr+WXEnsRORAxmoVtG4gUE5NR:ALr9"
          },
          {
            "category": "Other",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "size-in-bytes",
            "timestamp": "1780621795",
            "to_ids": false,
            "type": "size-in-bytes",
            "uuid": "e2b1fc88-93d8-49de-85ba-7a59581d8bf1",
            "value": "3884908"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": false,
            "object_relation": "vhash",
            "timestamp": "1780621795",
            "to_ids": true,
            "type": "vhash",
            "uuid": "4647231a-b8e3-4934-8572-01021a767e33",
            "value": "4b37ee64e39a6449904a4968eb4bf1ed"
          },
          {
            "category": "Payload delivery",
            "comment": "",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "filename",
            "timestamp": "1780621795",
            "to_ids": true,
            "type": "filename",
            "uuid": "bd985180-95f3-491f-b2c0-7b7edfa8f01a",
            "value": "index.js"
          },
          {
            "category": "Other",
            "comment": "Checked: 05/06/2026\nLast-scan\t:  04/06/2026",
            "deleted": false,
            "disable_correlation": true,
            "object_relation": "text",
            "timestamp": "1780621795",
            "to_ids": false,
            "type": "text",
            "uuid": "d2cbd4ce-736c-441d-a423-2d29db51aac5",
            "value": "index.js (from @redhat-cloud-services/chrome-2.3.4)\r\nType Description: JavaScript\nMicrosoft: Trojan:JS/ObfusNpmJs\nVT Total Detection:18/61\nFirst Submission:2026-06-03T06:57:01.000000+00:00\nLast Submission:2026-06-03T06:57:01.000000+00:00"
          }
        ]
      }
    ]
  }
}