On June 1, 2026, 32 packages in the @redhat-cloud-services npm scope — totalling 116,991 weekly downloads — were backdoored by Miasma, a new Shai-Hulud variant that steals credentials across AWS, GCP, Azure, and Kubernetes through a preinstall hook. No CVE exists. Every malicious version passed npm Trusted Publishing validation using legitimate OIDC-issued tokens, leaving CVE-dependent scanners with zero detection surface during the active exposure window.