FlagThis

Abstract

This report details two high-impact cybersecurity incidents: the "Miasma" supply-chain attack involving the compromise of @redhat-cloud-services npm packages through the abuse of GitHub Actions Trusted Publishing, and the "ShinyHunters" breach of the Canvas Learning Management System, which resulted in the theft of 275 million educational records. Both incidents highlight critical vulnerabilities in CI/CD workflows and consumer-grade account mechanisms within massive software ecosystems.