A new Mini Shai-Hulud supply chain attack campaign codenamed Miasma compromised @redhat-cloud-services npm packages using obfuscated preinstall hooks. The malware collects GitHub Actions secrets, npm tokens, cloud credentials, Kubernetes and Vault material, SSH keys, Git credentials, and other sensitive files. It uses encrypted exfiltration to api.anthropic[.]com:443/v1/api with GitHub as fallback. The malware avoids execution on Russian-language systems, generates uniquely encrypted payloads for each infection, and includes privilege escalation, endpoint protection checks, and persistence mechanisms through SessionStart hooks and Visual Studio Code tasks.json injection. It targets cloud identities specifically for GCP and Azure, and can weaponize stolen credentials to further poison the software supply chain.