A Worm in the Registry, Wearing a Vendor’s Name

The campaign reported as Miasma compromised npm packages associated with Red Hat, delivering a credential-stealing worm. Two properties make it worth separating from the year’s other registry attacks.

Guidance to developers evaluating a dependency invariably includes checking who publishes it. A package under a major vendor’s namespace passes that check trivially, and passes the informal version too: an engineer scanning a dependency list stops on the unfamiliar names, not the recognised one.

Compromising publish access to such a namespace therefore delivers more than distribution. It delivers the reviewer’s assumption that this particular entry did not need review.

Self-propagation means the affected set grows without further attacker action. Between compromise and detection, stolen credentials are being used to publish further packages, each of which reaches its own dependents.

Incident response designed around a fixed blast radius does not fit. There is no single list of affected projects to enumerate, because the list was still growing while it was being written.

The remediation guidance is the same as every other campaign in this class, and organisations are by now tired of it: treat any secret readable from an affected build environment as compromised, and rotate it. Fatigue is a genuine risk here, and it is what the attackers are relying on.