According to the SlowMist Security Team, they have detected an active npm supply chain attack targeting Red Hat cloud service packages, affecting over 31 software packages (approximately 116k downloads per week), resulting in the theft of credentials from more than 300 GitHub repositories. The attack is similar to the previous Shai-Hulud movement, implementing automated leaks of secrets and wallet data through the feature tag “Miasma: The Spreading Blight,” and the scope of victims is still expanding. Attackers may steal cloud credentials, SSH keys, and local wallet data. SlowMist recommends affected users immediately uninstall or downgrade related components, audit CI/CD workflows, thoroughly rotate all keys and wallet assets, and rebuild exposed machine environments.