Red Hat npm Packages Compromised

Overview A major supply‑chain compromise has struck Red Hat’s @redhat‑cloud‑services namespace on npm, with over 30 packages backdoored to distribute a new variant of the Shai‑Hulud credential‑stealing malware, now dubbed Miasma.

Security firms Aikido and OX Security discovered the breach, identifying 32 packages and 96 versions infected with malicious code designed to harvest developer credentials, cloud secrets, SSH keys, CI/CD tokens, and other sensitive data. The affected packages collectively receive around 117,000 weekly downloads, underscoring the scale of exposure.

How the Attack Unfolded

According to Aikido, attackers compromised a Red Hat employee’s GitHub account and pushed malicious commits directly to multiple repositories.

The injected workflow abused GitHub Actions and npm’s trusted publishing mechanism to release backdoored versions automatically.

1. GitHub Compromise → Attacker gains access to employee account.
2. Malicious Workflow Injection → Adds scripts that install Bun and execute _index.js.
3. OIDC Token Abuse → Requests short‑lived OIDC tokens to authenticate with npm’s trusted publishing endpoint.
4. Backdoored Packages Published → Each package version includes a preinstall script executing a 4.2 MB obfuscated index.js payload.

json

"scripts": {
  "preinstall": "node index.js"
}

The payload exfiltrates secrets from GitHub Actions, AWS, Google Cloud, Azure, HashiCorp Vault, Kubernetes, npm, PyPI, Docker, GPG, and local .env files.

Red Hat’s Response

Red Hat confirmed the incident, stating:

“We immediately initiated an investigation and removed the packages from the npm registry. The packages were strictly limited to internal development and were never published for customer consumption.”

The company emphasized that no customer or partner environments were affected and that production systems remain secure.

However, organizations that installed any affected versions are urged to rotate all credentials and audit infected devices immediately.

Miasma — The New Shai‑Hulud Variant

Researchers describe Miasma as an evolved strain of the Mini Shai‑Hulud malware framework, publicly leaked by the TeamPCP threat group in May.

While retaining the same credential‑stealing capabilities, Miasma introduces:

• Enhanced obfuscation layers
• Multi‑stage payload delivery
• Expanded data harvesting across cloud and CI/CD ecosystems

Researchers found “Miasma: The Spreading Blight” comments embedded in compromised GitHub repositories — a signature linking the campaign to the broader Shai‑Hulud lineage.

At the time of writing, 309 GitHub repositories have been compromised by the Miasma malware campaign.

Mitigation Steps

Security teams should act immediately:

• Remove affected packages from all environments.
• Rotate all secrets — including cloud keys, CI/CD tokens, and SSH credentials.
• Scan for obfuscated index.js payloads in npm dependencies.
• Implement trusted publishing controls with strict OIDC permissions.
• Monitor for Shai‑Hulud indicators across repositories and build pipelines.

Expert in the Cloud Insight

The Red Hat Miasma incident highlights the fragility of developer ecosystems and the growing sophistication of supply‑chain attacks. By exploiting trusted publishing mechanisms and OIDC tokens, attackers bypass traditional perimeter defenses and infiltrate directly into CI/CD pipelines.

For defenders, the lesson is clear: credential hygiene, repository integrity, and continuous dependency auditing are now mission‑critical.