npm Supply Chain Attacks: Shai-Hulud, Miasma, and CI/CD Compromises

The npm ecosystem has entered a critical phase, marked by an aggressive acceleration in supply chain compromises. What began as isolated typosquatting incidents has evolved into systematic campaigns weaponizing the inherent trust in modern software development. The Shai-Hulud worm in September 2025 served as a watershed moment, transitioning the threat landscape from minor nuisances to high-consequence attacks capable of automated compromise and redistribution of malicious packages, as detailed by Unit 42.

The Evolving npm Threat Landscape

Since the Shai-Hulud incident, threat actors have refined their tactics, techniques, and procedures (TTPs). Recent campaigns tracked by Unit 42 include “Shai-Hulud: The Third Coming” and “Mini Shai-Hulud” in April 2026, with the latter continuing into May 2026, attributed to the group TeamPCP. These campaigns introduced new elements, such as credential-free initial access methods and record-high malicious package counts published in a single hour. The increasing sophistication and copycat activity make pinpointing attribution more challenging.

Attackers are systematically exploiting the npm registry as a force multiplier for malware distribution, focusing on compromise themes like credential theft, pipeline manipulation, and widespread package backdooring. Understanding how to detect Miasma RAT npm compromise and securing the broader developer workflow is paramount.

Noteworthy Campaigns and Tactics

Credential Theft via Malicious Bitwarden CLI

In one prominent campaign attributed to TeamPCP, a malicious npm package masquerading as @bitwarden/cli version 2026.4.0 was identified. Upon installation, this package executes a multi-stage payload designed to steal credentials from critical developer environments, including cloud providers, CI/CD systems, and developer workstations. A key feature of this attack is its self-propagation mechanism: once a victim is compromised, the malware backdoors every npm package the victim is authorized to publish, significantly expanding its reach and impact across the supply chain.

Red Hat and AsyncAPI Compromises with Miasma RAT

Further demonstrating advanced supply chain techniques, a June 1, 2026, attack compromised at least 32 packages under the @redhat-cloud-services npm namespace. Attackers deployed a payload named Miasma, bypassing code review entirely. This payload, identified as a descendant of the Miasma Remote Access Trojan (RAT), reappeared in a July 14, 2026, campaign targeting the release pipelines of four core AsyncAPI GitHub repositories. This particular campaign, dubbed miasma-train-p1, resulted in the publication of five trojanized npm packages.

The AsyncAPI compromise illustrated a shift in initial access. Instead of compromised employee accounts, attackers exploited a process gap within the CI/CD pipeline itself. Despite strict branch protections and peer-review mandates on primary main branches, pre-production release branches, specifically next and schema, were left unprotected. Threat actors pushed malicious commits directly to these shadow branches, circumventing human review and triggering automated GitHub Actions build and release workflows. This allowed the injected code to run within the Continuous Integration (CI) runner, harvesting sensitive environment secrets like NPM_TOKEN and GITHUB_TOKEN to programmatically publish backdoored package versions to the trusted @asyncapi scope on the public registry. Securing CI/CD pipeline security npm tokens is clearly a critical focus area.

The Miasma RAT payload has evolved, too. When a developer installs a compromised package, a backdoored source file (e.g., index.js) executes. To evade static analysis, it exports legitimate-looking data, but its main() function triggers a detached child process running an obfuscated script. This script determines the operating system, creates a platform-specific persistence directory disguised as a legitimate Node.js data folder, and fetches the Stage-2 Miasma RAT from the InterPlanetary File System (IPFS) using hard-coded content identifiers (e.g., Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf). The RAT establishes persistence via user-scoped systemd services on Linux/macOS or Run keys on Windows, operating headlessly in the background to avoid detection.

Actionable Recommendations for npm Supply Chain Attack Mitigation

Defending against these sophisticated npm supply chain attacks requires a multi-layered approach, focusing on development practices and infrastructure security:

• Strengthen CI/CD Pipeline Security: Implement rigorous security controls for CI/CD pipelines, including least privilege access for build agents, strict environment variable management, and continuous monitoring for unusual activity. Ensure all branches, especially those triggering automated builds, have strong branch protections and mandatory code reviews.
• Enforce Strict Branch Protections: Extend comprehensive branch protection rules and peer-review mandates to all development and pre-production branches, not just main or master branches, to prevent malicious commits from bypassing human review.
• Review npm Package Dependencies: Regularly audit and review all third-party npm package dependencies. Utilize tools that can detect malicious or vulnerable packages and monitor for unexpected changes in package behavior or dependencies.
• Implement Software Supply Chain Security Solutions: Deploy solutions that can analyze package integrity, monitor npm registry for suspicious publications, and detect anomalous build system behavior. Consider implementing reproducible builds to verify package provenance.
• Secure Developer Workstations: Protect developer environments with strong endpoint detection and response (EDR) solutions, multi-factor authentication (MFA) for all critical systems, and regular security awareness training to recognize phishing and social engineering attempts.
• Rotate and Monitor API Tokens: Regularly rotate NPM_TOKEN and GITHUB_TOKEN credentials and monitor their usage for any unauthorized or unusual access patterns. Ensure these tokens are never hard-coded or exposed in public repositories.

Related: Shai-Hulud Campaign: TeamPCP Targets Open-Source Supply Chain, Shai-Hulud Infostealer Surfaces in Malicious npm Package Campaign