# npm Supply Chain Attacks: Shai-Hulud, Miasma, and CI/CD Compromises

> The npm ecosystem faces escalating supply chain attacks like Shai-Hulud and Miasma RAT, leading to credential theft and widespread package compromise.

- Published: 2026-08-08T16:26:28.000Z
- Severity: high
- Category: Supply Chain
- Tags: NPM, Supply Chain Attack, Shai Hulud, TeamPCP, CI CD Security
- Author: Runtime Rebel Intel
- Primary source: https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/
- Canonical: https://runtimerebel.com/blog/npm-supply-chain-attacks-shai-hulud-miasma-and-ci-cd-compromises

## Key points

- Immediate impact: npm supply chain attacks are escalating, leading to credential theft and widespread malware distribution via compromised packages.
- Affected systems: npm packages under developer scopes, CI/CD pipelines, and developer workstations using compromised packages.
- Remediation: Strengthen CI/CD pipeline security, enforce branch protections, and thoroughly review all npm package dependencies.

The npm ecosystem has entered a critical phase, marked by an aggressive acceleration in supply chain compromises. What began as isolated [typosquatting](/glossary#typosquatting) incidents has evolved into systematic campaigns weaponizing the inherent trust in modern software development. The Shai-Hulud [worm](/glossary#worm) in September 2025 served as a watershed moment, transitioning the [threat landscape](/glossary#threat-landscape) from minor nuisances to high-consequence attacks capable of automated compromise and redistribution of malicious packages, as detailed by [Unit 42](https://unit42.paloaltonetworks.com/monitoring-npm-supply-chain-attacks/).

## The Evolving npm Threat Landscape

Since the Shai-Hulud incident, threat actors have refined their tactics, techniques, and procedures (TTPs). Recent campaigns tracked by Unit 42 include "Shai-Hulud: The Third Coming" and "Mini Shai-Hulud" in April 2026, with the latter continuing into May 2026, attributed to the group TeamPCP. These campaigns introduced new elements, such as credential-free [initial access](/glossary#initial-access) methods and record-high malicious package counts published in a single hour. The increasing sophistication and copycat activity make pinpointing [attribution](/glossary#attribution) more challenging.

Attackers are systematically exploiting the npm registry as a force multiplier for [malware](/glossary#malware) distribution, focusing on compromise themes like [credential theft](/glossary#credential-theft), pipeline manipulation, and widespread package backdooring. Understanding how to detect Miasma RAT npm compromise and securing the broader developer workflow is paramount.

## Noteworthy Campaigns and Tactics

### Credential Theft via Malicious Bitwarden CLI

In one prominent campaign attributed to TeamPCP, a malicious npm package masquerading as `@bitwarden/cli` version 2026.4.0 was identified. Upon installation, this package executes a multi-stage [payload](/glossary#payload) designed to steal credentials from critical developer environments, including cloud providers, [CI/CD](/glossary#ci-cd) systems, and developer workstations. A key feature of this attack is its self-propagation mechanism: once a victim is compromised, the malware backdoors every npm package the victim is authorized to publish, significantly expanding its reach and impact across the supply chain.

### Red Hat and AsyncAPI Compromises with Miasma RAT

Further demonstrating advanced supply chain techniques, a June 1, 2026, attack compromised at least 32 packages under the `@redhat-cloud-services` npm namespace. Attackers deployed a payload named Miasma, bypassing code review entirely. This payload, identified as a descendant of the Miasma [Remote Access Trojan (RAT)](/glossary#remote-access-trojan-rat), reappeared in a July 14, 2026, campaign targeting the release pipelines of four core AsyncAPI GitHub repositories. This particular campaign, dubbed `miasma-train-p1`, resulted in the publication of five trojanized npm packages.

The AsyncAPI compromise illustrated a shift in initial access. Instead of compromised employee accounts, attackers exploited a process gap within the CI/CD pipeline itself. Despite strict branch protections and peer-review mandates on primary `main` branches, pre-production release branches, specifically `next` and `schema`, were left unprotected. Threat actors pushed malicious commits directly to these shadow branches, circumventing human review and triggering automated GitHub Actions build and release workflows. This allowed the injected code to run within the Continuous Integration (CI) runner, harvesting sensitive environment secrets like `NPM_TOKEN` and `GITHUB_TOKEN` to programmatically publish backdoored package versions to the trusted `@asyncapi` scope on the public registry. Securing CI/CD pipeline security npm tokens is clearly a critical focus area.

The Miasma RAT payload has evolved, too. When a developer installs a compromised package, a backdoored source file (e.g., `index.js`) executes. To evade static analysis, it exports legitimate-looking data, but its `main()` function triggers a detached child process running an obfuscated script. This script determines the operating system, creates a platform-specific [persistence](/glossary#persistence) directory disguised as a legitimate Node.js data folder, and fetches the Stage-2 Miasma RAT from the InterPlanetary File System (IPFS) using hard-coded content identifiers (e.g., `Qmet4fhsAaWMBUxNDfREHwgiyDeSWy4YSYs9wiKUW5jGyf`). The RAT establishes persistence via user-scoped `systemd` services on Linux/macOS or `Run` keys on Windows, operating headlessly in the background to avoid detection.

## Actionable Recommendations for npm [Supply Chain Attack](/glossary#supply-chain-attack) Mitigation

Defending against these sophisticated npm supply chain attacks requires a multi-layered approach, focusing on development practices and infrastructure security:

*   **Strengthen CI/CD Pipeline Security**: Implement rigorous security controls for CI/CD pipelines, including [least privilege](/glossary#least-privilege) access for build agents, strict environment variable management, and continuous monitoring for unusual activity. Ensure all branches, especially those triggering automated builds, have strong branch protections and mandatory code reviews.
*   **Enforce Strict Branch Protections**: Extend comprehensive branch protection rules and peer-review mandates to all development and pre-production branches, not just `main` or `master` branches, to prevent malicious commits from bypassing human review.
*   **Review npm Package Dependencies**: Regularly audit and review all third-party npm package dependencies. Utilize tools that can detect malicious or vulnerable packages and monitor for unexpected changes in package behavior or dependencies.
*   **Implement Software Supply Chain Security Solutions**: Deploy solutions that can analyze package integrity, monitor npm registry for suspicious publications, and detect anomalous build system behavior. Consider implementing reproducible builds to verify package provenance.
*   **Secure Developer Workstations**: Protect developer environments with strong [endpoint](/glossary#endpoint) detection and response ([EDR](/glossary#edr)) solutions, multi-factor authentication ([MFA](/glossary#mfa)) for all critical systems, and regular [security awareness training](/glossary#security-awareness-training) to recognize [phishing](/glossary#phishing) and [social engineering](/glossary#social-engineering) attempts.
*   **Rotate and Monitor [API](/glossary#api) Tokens**: Regularly rotate `NPM_TOKEN` and `GITHUB_TOKEN` credentials and monitor their usage for any unauthorized or unusual access patterns. Ensure these tokens are never hard-coded or exposed in public repositories.

**Related:** [Shai-Hulud Campaign: TeamPCP Targets Open-Source Supply Chain](/blog/shai-hulud-campaign-teampcp-targets-open-source-supply-chain), [Shai-Hulud Infostealer Surfaces in Malicious npm Package Campaign](/blog/shai-hulud-infostealer-surfaces-in-malicious-npm-package-campaign)

---

AI-generated analysis from the primary source above; not human-reviewed before publication — verify anything operational against the original (https://runtimerebel.com/editorial). Quote with attribution and a link to the canonical URL: https://runtimerebel.com/blog/npm-supply-chain-attacks-shai-hulud-miasma-and-ci-cd-compromises