Preinstall to Persistence: Inside the Red Hat npm Miasma Credential-Theft Campaign

SOC Prime Team

Preinstall to Persistence: Inside the Red Hat npm Miasma Credential-Theft Campaign

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

Microsoft Defender identified a supply-chain compromise affecting 32 npm packages published under the @redhat-cloud-services namespace. The attackers embedded a pre-install hook that deploys a heavily obfuscated JavaScript loader, which then retrieves the Bun runtime and a second-stage credential stealer. The malware harvests tokens from GitHub, npm, major cloud providers, HashiCorp Vault, and Kubernetes, then republishes poisoned packages to continue spreading. The campaign also includes a destructive safeguard that wipes the victim’s home directory if a decoy token is detected.

Investigation

The investigation traced the initial breach to a compromised CI/CD pipeline for RedHatInsights/javascript-clients, where the attackers abused a legitimate GitHub Actions OIDC workflow to publish trojanized packages with valid provenance signatures. Analysis of the dropper exposed multiple layers of obfuscation, including ROT-based encoding, AES-128-GCM encryption, and a custom cipher, before Bun was executed to launch the second-stage payload. The threat actors also scraped memory from GitHub Actions runners to extract secrets directly from active processes.

Mitigation

Microsoft recommends reviewing dependency trees for the affected @redhat-cloud-services packages, pinning trusted versions, and disabling npm script execution with the --ignore-scripts flag where possible. All compromised npm tokens should be revoked and reissued, and GitHub accounts should be reviewed for unauthorized repository creation or suspicious activity. Additional safeguards have since been implemented within the @redhat-cloud-services namespace to prevent unauthorized publishing.

Response

Defenders should detect suspicious npm pre-install execution and unexpected Bun runtime launches from temporary directories. Monitoring should also cover creation of unknown public GitHub repositories and unusual token usage patterns. Network defenses should block or alert on connections to known Bun download URLs and the api.anthropic.com domain. Any potentially exposed credentials should be rotated immediately, and CI/CD runner memory should be investigated for signs of leaked secrets.

"graph TB %% Class Definitions classDef action fill:#99ccff classDef tool fill:#cccccc classDef malware fill:#ffcc99 classDef process fill:#ff9966 %% Nodes node_sc_001["Action – T1195.001 Supply Chain Compromise: Compromise Software Dependencies and Development Tools Attacker hijacked the RedHatInsights/javascript-clients CI/CD pipeline and used GitHub Actions OIDC to publish trojanized @redhat-cloud-services npm packages."] class node_sc_001 action tool_github_oidc["Tool – Name: GitHub Actions OIDC Description: OpenID Connect integration that provides shortu2011lived tokens to CI workflows."] class tool_github_oidc tool malicious_preinstall["Malware – T1127.003 Trusted Developer Utilities Proxy Execution: Malicious preu2011install hook in package.json executed automatically during <code>npm install</code>, spawning <code>node index.js</code>."] class malicious_preinstall malware installer_trigger["Action – T1546.016 Event Triggered Execution: Installeru2011package trigger that runs the dropper when the preu2011install script is invoked."] class installer_trigger action obfuscated_payload["Malware – T1027.009 Obfuscated Files or Information: Embedded payload (4.29u202fMB index.js) using multiu2011layer ROT, AESu2011128u2011GCM, stringu2011array and custom PBKDF2 cipher to hide its code."] class obfuscated_payload malware dynamic_resolution["Malware – T1027.007 Obfuscated Files or Information: Dynamic API resolution u2013 runtime deobfuscation resolves URLs for the Bun runtime and C2 endpoints."] class dynamic_resolution malware ingress_transfer["Action – T1105 Ingress Tool Transfer: Dropper downloads the Bun JavaScript runtime from official release URLs before executing the secondu2011stage payload."] class ingress_transfer action tool_bun_runtime["Tool – Name: Bun JavaScript Runtime Description: Highu2011performance JavaScript engine used as the execution environment for the second stage."] class tool_bun_runtime tool metadata_query["Action – T1552.005 Unsecured Credentials: Cloud Instance Metadata API Queries AWS/ECS, Azure IMDS and GCP metadata services to obtain cloud access tokens."] class metadata_query action file_credential["Action – T1552.001 Unsecured Credentials: Credentials In Files Scrapes local files for SSH keys, CLI configs, cryptocurrency wallet files and other secret material."] class file_credential action token_harvest["Action – T1528 Steal Application Access Token: Harvests GitHub Actions runner tokens, npm OIDC tokens and other provider tokens."] class token_harvest action browser_discovery["Action – T1217 Browser Information Discovery: Collects browser stores and cryptocurrency wallet files from developer workstations."] class browser_discovery action elevation_control["Action – T1548 Abuse Elevation Control Mechanism: Installs a passwordu2011less sudo rule via a bindu2011mounted <code>/etc/sudoers.d</code> to gain root privileges."] class elevation_control action exfiltration_git["Action – T1048 Exfiltration Over Alternative Protocol: Exfiltrates stolen credentials by creating GitHub repositories under the victimu2019s account, committing JSON files, and also uses an alternate HTTPS endpoint."] class exfiltration_git action destructive_cleanup["Action – T1070.010 Indicator Removal: Relocates malware and, if a decoy token was used, executes <code>rm -rf ~/</code> to wipe the useru2019s home directory."] class destructive_cleanup action node_sc_002["Action – T1195.002 Supply Chain Compromise: Compromise Software Supply Chain u2013 republished poisoned packages with forged SLSA provenance, enabling wormu2011like propagation to downstream projects."] class node_sc_002 action %% Connections node_sc_001 –>|uses| tool_github_oidc tool_github_oidc –>|executes| malicious_preinstall malicious_preinstall –>|triggers| installer_trigger installer_trigger –>|executes| obfuscated_payload obfuscated_payload –>|performs| dynamic_resolution dynamic_resolution –>|downloads| ingress_transfer ingress_transfer –>|installs| tool_bun_runtime tool_bun_runtime –>|queries| metadata_query metadata_query –>|scrapes| file_credential file_credential –>|harvests| token_harvest token_harvest –>|collects| browser_discovery browser_discovery –>|enables| elevation_control elevation_control –>|exfiltrates via| exfiltration_git exfiltration_git –>|may trigger| destructive_cleanup destructive_cleanup –>|facilitates| node_sc_002 node_sc_002 –>|propagates to| node_sc_001 "

Attack Flow

Attack Narrative & Commands:
An adversary who has already compromised a GCE VM uses a living‑off‑the‑land approach to harvest the VM’s default service‑account token. The steps are:
1. Probe the metadata server to verify it is reachable.
2. Issue a token request to http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token with the required Metadata-Flavor: Google header.
3. Save the returned JSON (contains access_token, expires_in, token_type).
4. Use the token to call a privileged GCP API (e.g., list all buckets) to demonstrate actionable credentials.
This exact sequence generates the audit event GCPServiceAccountTokenAccess, which matches the Sigma rule’s selection.

Regression Test Script:

#!/usr/bin/env bash
set -euo pipefail

# 1. Verify metadata server reachability
echo "[*] Probing metadata server..."
curl -s -H "Metadata-Flavor: Google" 
  "http://metadata.google.internal/computeMetadata/v1/instance/id" >/dev/null

# 2. Harvest the default service‑account token
echo "[*] Requesting service‑account token..."
TOKEN_RESPONSE=$(curl -s -H "Metadata-Flavor: Google" 
  "http://metadata.google.internal/computeMetadata/v1/instance/service-accounts/default/token")

echo "[+] Token response received:"
echo "${TOKEN_RESPONSE}" | jq .

# 3. Extract the access token
ACCESS_TOKEN=$(echo "${TOKEN_RESPONSE}" | jq -r '.access_token')

# 4. Use the token to list GCS buckets (demonstrates token utility)
echo "[*] Using token to list GCS buckets..."
curl -s -H "Authorization: Bearer ${ACCESS_TOKEN}" 
  "https://storage.googleapis.com/storage/v1/b" | jq .

echo "[+] Simulation complete. The above actions should have produced a GCPServiceAccountTokenAccess audit event."

Cleanup Commands:

# No persistent changes were made; only removing temporary variables.
unset TOKEN_RESPONSE ACCESS_TOKEN
echo "[*] Cleanup complete."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free