Miasma compromises Red Hat npm packages through a trusted publishing workflow
Wiz and JFrog describe malicious Red Hat npm releases that steal developer secrets, abuse publishing identities and retain valid provenance despite compromised workflows.
Tags /
#Supply Chain
2 reports
The @antv and Nx Console compromises: tracking malicious packages, extensions and GitHub Actions
Malicious npm packages, Nx Console 18.95.0 and compromised GitHub Actions expose developer credentials. Installation history, persistent processes and publishing permissions define recovery.