Attackers compromised a Red Hat employee's GitHub account to push malicious commits that added GitHub Actions workflows and scripts. The malicious workflow uses OIDC tokens to authenticate with npm's trusted publishing endpoint and publish backdoored packages. Compromised packages contained a preinstall script that executed a heavily obfuscated 4.2 MB index.js payload. The malware is a variant of Shai-Hulud called 'Miasma' that steals credentials including GitHub Actions secrets, AWS credentials, Google Cloud credentials, Azure service principal credentials, HashiCorp Vault tokens, Kubernetes tokens, npm/PyPI tokens, SSH keys, Docker credentials, GPG keys, and .env files.