Full Report
RL has discovered the Miasma supply chain attack affecting 9.8M total downloads across Red Hat's Hybrid Cloud Console JavaScript ecosystem.
Analysis Summary
# Incident Report: Miasma Supply Chain Attack (Red Hat npm Ecosystem)
## Executive Summary
ReversingLabs (RL) discovered a coordinated supply chain attack, dubbed "Miasma," targeting the `@redhat-cloud-services` npm scope. On June 1, an attacker published malicious versions of 31 packages within a 72-second window, injecting obfuscated malware into the preinstall scripts. The incident affected approximately 9.8 million total downloads across Red Hat’s Hybrid Cloud Console ecosystem, resulting in potential cloud credential theft and system enumeration.
## Incident Details
- **Discovery Date:** June 2024 (by ReversingLabs)
- **Incident Date:** June 1, 2024
- **Affected Organization:** Red Hat (Hybrid Cloud Console ecosystem)
- **Sector:** Information Technology / Cloud Services
- **Geography:** Global
## Timeline of Events
### Initial Access
- **Date/Time:** June 1, 10:54:09 UTC
- **Vector:** Compromised publishing credentials (npm tokens) for the `@redhat-cloud-services` scope.
- **Details:** The attacker gained access to high-privilege publishing rights, allowing them to bypass typical security checks and publish directly to the npm registry.
### Lateral Movement
- The attack utilized a rapid-fire automated script to push malicious updates to 31 different packages in 72 seconds, effectively moving horizontally across the entire Red Hat JavaScript ecosystem.
### Data Exfiltration/Impact
- **Details:** The malware targeted developer environments and CI/CD pipelines. It was designed for cloud identity enumeration and the theft of sensitive credentials, likely aimed at pivoting into Red Hat’s cloud infrastructure or customer environments.
### Detection & Response
- **Detection:** Discovered by ReversingLabs through automated software supply chain monitoring.
- **Response actions taken:** Red Hat was notified, the incident was officially closed by Red Hat, and the malicious package versions were removed from the npm registry.
## Attack Methodology
- **Initial Access:** Compromised npm scope/contributor credentials.
- **Persistence:** Injection of `preinstall` scripts in `package.json`, ensuring the malware runs every time the package is installed or updated.
- **Privilege Escalation:** Not applicable (the attacker started with high-level publishing privileges).
- **Defense Evasion:** Use of heavily obfuscated JavaScript and valid SLSA (Supply-chain Levels for Software Artifacts) provenance to mimic legitimate builds.
- **Credential Access:** Targeting cloud identity metadata and local environment variables.
- **Discovery:** Automated cloud identity enumeration.
- **Lateral Movement:** Automated multi-package publishing.
- **Collection:** Gathering system metadata and cloud environment details.
- **Exfiltration:** Sending gathered data to attacker-controlled infrastructure.
- **Impact:** Backdooring of critical UI components, API clients, and build tools.
## Impact Assessment
- **Financial:** Undisclosed; however, the scale of 9.8M downloads suggests significant remediation costs.
- **Data Breach:** Exposure of cloud credentials and architectural metadata.
- **Operational:** Disruption to Red Hat’s Hybrid Cloud Console development and potential compromise of downstream users.
- **Reputational:** Significant impact due to the breach of a major open-source contributor and the exploitation of trusted SLSA provenance.
## Indicators of Compromise
- **File Indicators (SHA-256 Examples):**
- `tsc-transform-imports` v1.2.2: `b390d9f708760b799ee5482e8050ce093219140627fcaec6df8812ac9abb9a9b`
- `types` v3.6.1: `b86c5ae9e95bd841a595440faa3eb6317441e746f241ae8fd641ab59ed1d1966`
- **Behavioral Indicators:**
- Unscheduled package releases occurring in rapid succession (seconds apart).
- Obfuscated scripts executing during the `preinstall` phase of npm installation.
- Unexpected outbound connections to unknown IPs/domains during package installation.
## Response Actions
- **Containment:** Removal of the 31 malicious package versions from the npm registry.
- **Eradication:** Revocation of compromised npm publishing tokens.
- **Recovery:** Red Hat validated the integrity of their build systems and officially closed the incident after ensuring all malicious artifacts were purged.
## Lessons Learned
- **Credential Management:** Scope-level access in npm is a single point of failure; if one token is compromised, the entire ecosystem is at risk.
- **Provenance Limitations:** Valid SLSA provenance, while helpful, is not a silver bullet if the build environment or credentials itself are compromised.
- **Speed of Attack:** The 72-second window highlights that human monitoring is insufficient; automated, real-time supply chain analysis is required.
## Recommendations
- **MFA Enforcement:** Mandatory Multi-Factor Authentication for all npm contributors and maintainers.
- **Automated Scanning:** Implement binary and source code analysis for every third-party update before they are integrated into internal builds.
- **Token Scoping:** Use granular, short-lived tokens for CI/CD processes rather than long-lived scope-wide tokens.
- **Dependency Pinning:** Use lockfiles and hash verification to prevent the automatic ingestion of malicious "new" versions.