Miasma: The Spreading Blight

Distinct npm supply-chain campaign in the Shai-Hulud worm lineage, derived from / a variant of Mini Shai-Hulud. The @redhat-cloud-services incident (June 1, 2026) abused npm GitHub Actions trusted publishing, which binds trust to repository plus workflow filename rather than branch/ref/environment, to publish 64 malicious versions across 32 packages with valid SLSA provenance. NOTE: the campaign-identifier string "Miasma: The Spreading Blight" was NOT recovered in plaintext from any decoded artifact (it would live in the uncracked inner globalThis["f4abccab2"] PBKDF2+S-box layer); the name is tracked per maintainer request but is LOW CONFIDENCE / not directly observed in static analysis. Initial-access vector for the oidc-<hex> branch pushes remains UNCONFIRMED.