答案已发布2周前Last edited 5天前21 来源

Red Hat“瘴气”攻击：一个被盗的GitHub账户如何污染了32个npm包

2026年6月1日，一款名为“瘴气”的窃密蠕虫在32个Red Hat官方npm包中被发现，这96个恶意版本合计每周下载量约11.7万次；入侵源头是一名Red Hat员工的GitHub账户被盗。该蠕虫是TeamPCP组织开源工具Mini Shai Hulud的变种，会在开发者执行npm install时自动运行，大肆窃取云服务凭证、GitHub Actions机密、SSH密钥等敏感信息。

使用 Studio Global AI 搜索并核查事实浏览更多热门页面

915K0

Abstract representation of a supply chain attack on Red Hat npm packages showing a digital worm spreading through code repositories. — What was the Miasma supply chain attack against Red Hat npm packages on June 1, 2026 — including how the compromise occurred via a Red Hat eThe Miasma worm used a compromised Red Hat employee account to inject malicious code into the official npm supply chain.
AI 提示
Create a landscape editorial hero image for this Studio Global article: What was the Miasma supply chain attack against Red Hat npm packages on June 1, 2026 — including how the compromise occurred via a Red Hat e. Article summary: Here is a complete breakdown of the Miasma supply chain attack, confirmed by multiple security vendors and Red Hat's own advisory.. Topic tags: general, general web. Reference image context from search candidates: Reference image 1: visual subject "# Red Hat npm packages compromised in new Mini Shai-Hulud malware wave. Unknown attackers have compromised 30+ Red Hat Cloud Services npm packages with malware that goes after cred" source context "Red Hat npm packages compromised in new Mini Shai-Hulud malware wave - Help Net Security" Reference image 2: visual subject "# Miasma: Supply Chain Attack Targeting RedHat npm Packages. Detect and mitigate malicious npm pa
openai.com

2026年6月1日清晨，安全研究人员拉响了警报，揭露了一场悄无声息渗透进JavaScript生态的精密软件供应链攻击。这场被命名为“瘴气：蔓延的疫病”（Miasma: The Spreading Blight）的行动，在Red Hat官方的@redhat-cloud-services命名空间下，向32个npm包中植入了窃取凭证且能自我复制的蠕虫病毒。据统计，共有96个恶意包版本被识别出来，其合计每周下载量达到了惊人的约11.7万次。这起事件赤裸裸地警示我们，当单个开发者账户沦陷时，可能引发何等连锁的信任崩塌。

攻击者是如何得手的

攻击链条的起点并非什么高深莫测的零日漏洞，而是一次经典的账号失陷。攻击者成功取得了一名合法的Red Hat员工GitHub账户的控制权。正是这一个单点故障，为整个可信发布管道打开了大门，因为该账号对Red Hat在GitHub上的三个核心代码仓库拥有写入权限。

Studio Global AI

Search, cite, and publish your own answer

Use this topic as a starting point for a fresh source-backed answer, then compare citations before you share it.

使用 Studio Global AI 搜索并核查事实

人们还问