Miasma Worm Forges SLSA Provenance and Hides in binding.gyp as It Hits Red Hat, Vapi, and Leo Platform npm Packages

Overview

Through June 2026, a self-spreading npm worm that researchers call Miasma compromised packages across several unrelated maintainer ecosystems, each time using the same two innovations: it executed during installation through a build file rather than a lifecycle script, and it generated supply-chain provenance attestations that made the poisoned releases look legitimately signed. The campaign opened on June 1, 2026, when at least 32 package releases under the @redhat-cloud-services npm namespace were Trojanized, according to Wiz, and resurfaced through late June against other projects.

The attack matters less for the individual victims than for the techniques it normalized. By abusing the binding.gyp build descriptor and by forging Sigstore-backed provenance, Miasma sidestepped two defenses that the npm ecosystem has spent the past year promoting as answers to supply-chain attacks.

What We Know

The Red Hat compromise

Red Hat disclosed the incident on June 1, 2026, stating in security bulletin RHSB-2026-006 that “a compromised GitHub account was used to inject malicious code into packages maintained in a Red Hat GitHub organization” and to “push unauthorized commits to repositories in the RedHatInsights GitHub organization,” according to Red Hat. The affected packages are “frontend JavaScript libraries used in the Hybrid Cloud Console,” the bulletin says.

Wiz, which analyzed the payload alongside Aikido Security, reported that the attacker “requested GitHub’s OIDC identity token via id-token: write, then executed an obfuscated payload (_index.js) that published packages with valid SLSA provenance attestations,” according to Wiz. Wiz put the combined reach of the affected @redhat-cloud-services packages at approximately 80,000 weekly downloads. Cybersecurity Dive, which credited Aikido Security and Wiz with the discovery, reported 32 packages with 96 versions affected and over 116,000 accumulated downloads.

Red Hat said the blast radius was limited to development tooling. “Red Hat is aware of security reports regarding certain npm packages within our development tooling ecosystem,” the company told Cybersecurity Dive, adding that the packages were “strictly limited to internal development” and that “the malicious code was never published for customer use through the console.redhat.com system.” Red Hat said it had “not identified any impact to customer or partner environments or Red Hat production systems.” Its bulletin separately notes that the compromised packages “are not related to Red Hat managed cloud services such as Azure Red Hat OpenShift (ARO), OpenShift Dedicated (OSD), or Red Hat OpenShift Service on AWS (ROSA),” according to Red Hat.

A worm derived from Mini Shai-Hulud

The payload is a variant of the Mini Shai-Hulud malware family, and the campaign takes its name from repositories the worm creates carrying the description “Miasma: The Spreading Blight,” according to Wiz. Cybersecurity Dive reported that the same Mini Shai-Hulud strain had earlier targeted four SAP npm packages in April and Microsoft’s Durable Task package on PyPI.

The worm propagates by stealing credentials and using them to publish more poisoned packages. In GitHub Actions environments, “the payload scrapes the runner’s process memory to pull masked secrets back out in unmasked form,” according to Snyk. Once it has a publishing token, the worm performs an “npm OIDC token exchange” and “publishes the repackaged, signed tarball as a new version,” according to StepSecurity.

The binding.gyp execution trick

The campaign’s signature technique abuses binding.gyp, a file normally used to build native Node.js add-ons. When a package contains a binding.gyp file but no prebuilt binaries, “npm hands the package to node-gyp and runs node-gyp rebuild” automatically during installation, with no lifecycle script declared in package.json, according to Snyk. The weaponized file used GYP’s command-expansion syntax, <!(node index.js > /dev/null 2>&1 && echo stub.c), which “executes node index.js while node-gyp is merely configuring the build, long before any compiler runs,” Snyk found. StepSecurity measured the malicious descriptor at 157 bytes and said it “abuses a 157-byte binding.gyp file to trigger code execution during npm install, bypassing most install-script security checks entirely.”

The code that file launches is heavily obfuscated. The index.js payload was a 4.5 MB obfuscated file using a ROT-14 Caesar cipher wrapping an AES-128-GCM layer; a 907-byte blob downloads Bun v1.3.13 from official GitHub releases, and the roughly 649 KB main payload then runs under the Bun binary rather than Node.js, according to Snyk.

Forged provenance

The most consequential element is how the worm laundered trust. It “forges Sigstore provenance attestations through Fulcio and Rekor so reinfected packages can appear legitimately signed,” according to Snyk. StepSecurity described the same step: the worm “creates a transparency log entry on Rekor, and generates a SLSA v1 provenance attestation, making the package appear to have legitimate supply chain provenance.” Because the attestations were minted through a hijacked but genuine publishing pipeline, the provenance is technically valid rather than counterfeit.

Subsequent waves

Miasma did not stop at Red Hat. On June 3, an attacker “compromised 57 npm packages across 286+ malicious versions in a rolling campaign lasting under two hours,” according to StepSecurity. The firm said the largest victim was @vapi-ai/server-sdk, the official Vapi.ai voice AI server SDK with 408,000+ monthly downloads, “hit first at 23:30 UTC on June 3,” alongside ai-sdk-ollama (120,000+ monthly downloads) and more than 50 packages belonging to the maintainer jagreehal.

A further wave landed on June 24, 2026, when an attacker compromised the maintainer account czirker and published poisoned updates to packages in the LeoPlatform and RStreams ecosystems, according to Socket. Sonatype identified 23 malicious package versions tied to that wave. Socket reported that this stage also reached the Go ecosystem through github.com/verana-labs/verana-blockchain@v0.10.1-dev.20.

The credential haul is broad. Across waves the malware hunts for AWS, GCP, and Azure credentials, GitHub tokens and GitHub Actions secrets, HashiCorp Vault and Kubernetes service-account tokens, npm and PyPI publishing tokens, SSH keys, and password-manager data including 1Password, according to Snyk. Socket’s analysis of the June 24 wave added Slack tokens, Twilio tokens, Docker authentication files, shell history, and “IDE or AI-agent configuration paths” to the target list, according to Socket.

What We Don’t Know

Reporting differs on the precise reach of the Red Hat compromise: Wiz cited roughly 80,000 weekly downloads while Cybersecurity Dive cited over 116,000 accumulated downloads, and the two figures are not directly comparable. The number of downstream developers who actually installed a poisoned version during the live windows is not established in the cited reporting.

It is also unclear how the initiating maintainer accounts were taken over in each wave. Red Hat attributes the first wave to “a compromised GitHub account” without detailing how that account was breached, and the later waves against jagreehal and czirker are likewise described as account compromises without a confirmed initial-access vector. Whether a single operator or a shared open-sourced toolkit drove all three waves is not definitively resolved in the sources.

Analysis

Miasma is a stress test for the two defenses the JavaScript ecosystem has leaned on hardest. Install-time script blocking, now common in hardened CI configurations, assumes malicious code announces itself through preinstall or postinstall hooks in package.json. The binding.gyp path runs no such hook; node-gyp is doing what it is designed to do. Provenance attestation, meanwhile, was meant to let consumers verify that a package was built by the pipeline its maintainer claims. By stealing the publishing identity and minting genuine Sigstore entries on Rekor, the worm produces attestations that pass verification while pointing at a hijacked build.

That combination is why the campaign reached organizations as different as a Linux distributor, a voice-AI startup, and a data-streaming platform within a few weeks. As Sonatype put it, “A trusted package is only as trustworthy as its latest release,” according to Sonatype. The practical mitigation the responders converge on is unglamorous: developers who pulled affected versions should rotate CI secrets, cloud credentials, SSH keys, and npm tokens, according to Cybersecurity Dive, because a valid signature on a poisoned release no longer guarantees much.