Provenance Record

Clear, well-structured Analysis piece (1,294 words, within the 800-2,000 Analysis range). Overview/What We Know/What We Don't Know/Analysis structure is appropriate; technical specifics (binding.gyp command-expansion, ROT/AES/Bun payload chain, Sigstore/Fulcio/Rekor provenance forgery) are explained accurately without sensationalism.

Read all 7 committed gzipped snapshots from sources/2026-06/miasma-worm-forges-slsa-provenance-and-hides-in-bindinggyp-as-it-hits-red-hat-vapi-and-leo-platform-npm-packages/ (source-0 through source-6, all HTTP 200, no failed captures). source-0 Wiz: confirms 'at least 32 package releases' under @redhat-cloud-services on June 1 2026, ~80,000 weekly downloads, the id-token/_index.js/SLSA quote (verbatim), and 'Miasma: The Spreading Blight'. source-1 Red Hat RHSB-2026-006: confirms 'compromised GitHub account' quote, 'RedHatInsights GitHub organization', 'frontend JavaScript libraries used in the Hybrid Cloud Console', and ARO/OSD/ROSA exclusion (all verbatim). source-2 Cybersecurity Dive: confirms 96 versions across 32 packages, 116,000+ accumulated downloads, Aikido+Wiz credit, all four Red Hat statement quotes (verbatim), SAP-April / Durable-Task-PyPI history, and the rotate-CI-secrets guidance. source-3 StepSecurity: confirms '57 packages across 286+ malicious versions ... under two hours', @vapi-ai/server-sdk 408,000+ monthly downloads hit at 23:30 UTC June 3, ai-sdk-ollama 120,000+, 50+ jagreehal packages, the 157-byte binding.gyp quote, npm OIDC token exchange, and the Rekor/SLSA-v1 provenance quote (all verbatim). source-4 Snyk: confirms node-gyp rebuild mechanism quote, the command-expansion quote, the Fulcio/Rekor Sigstore forgery quote, the runner-memory-scraping quote, and the 4.5MB/ROT-14/AES-128-GCM/907-byte-Bun-v1.3.13/~649KB payload chain (all verbatim/accurate). source-5 Socket: confirms June 24 czirker LeoPlatform/RStreams wave, the verana-blockchain@v0.10.1-dev.20 Go finding, and the Slack/Twilio/Docker/shell-history/'IDE or AI-agent configuration paths' target list (verbatim). source-6 Sonatype: confirms '23 malicious package versions', czirker, and the 'trusted package is only as trustworthy as its latest release' quote (verbatim).

Every number (32 packages/96 versions, 80,000 vs 116,000 downloads, 57 packages/286+ versions, 408,000 / 120,000 monthly downloads, 157 bytes, 4.5 MB, 907 bytes, 649 KB, Bun v1.3.13, 23 versions, June 1/3/24 dates) traces to the cited source. Headline, summary and Overview lead are fully supported by Wiz + Red Hat (primary sources, satisfying Rule 9 attribution of timeline/technical specifics to the primary write-up rather than trade press). ONE misattribution found: the credential-haul sentence in 'Subsequent waves' attributes 'npm and PyPI publishing tokens, SSH keys' to Snyk, but the Snyk snapshot's credential-harvesting list does NOT include PyPI tokens or SSH keys (it lists AWS/GCP/Azure, GitHub Actions, Vault/Kubernetes, npm tokens, and 1Password/pass/gopass). Both omitted specifics ARE accurately documented in the cited Socket source (which explicitly lists 'npm and PyPI tokens ... SSH keys'). This is a single, honestly-summarizable cite error in a subordinate body clause, not the headline/summary/lead — APPROVE_WITH_CORRECTIONS rather than REJECT.

Substantively strong, accurately sourced Analysis of a genuinely new supply-chain incident. All load-bearing claims (headline, summary, lead, timeline, technical mechanism, quotes) are verbatim/accurate against the primary sources. One recoverable cite misattribution in a body subordinate clause is honestly covered by a corrections record. APPROVE_WITH_CORRECTIONS.