#npm

Miasma compromises Red Hat npm packages through a trusted publishing workflow

Wiz and JFrog describe malicious Red Hat npm releases that steal developer secrets, abuse publishing identities and retain valid provenance despite compromised workflows.