---
title: Supply Chain Attack Hits 32 Red Hat NPM Packages
description: Hackers hit Red Hat's NPM, injecting malware in 32 packages. Users must update and secure credentials as 10M downloads are compromised.
canonical_url: https://codekeeper.co/ticker/red-hat-npm-hack-malware-attack
---

# Supply Chain Attack Hits 32 Red Hat NPM Packages

Hackers hit Red Hat's NPM, injecting malware in 32 packages. Users must update and secure credentials as 10M downloads are compromised.

![Content Team](https://codekeeper.co/hubfs/_sized/Codekeeper_21_beeldmerkL-800.png)

By Content Team Jun 2, 2026

Share [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fred-hat-npm-hack-malware-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fred-hat-npm-hack-malware-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fred-hat-npm-hack-malware-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fred-hat-npm-hack-malware-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fred-hat-npm-hack-malware-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fred-hat-npm-hack-malware-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

ON THIS PAGE

### Want more insights like this?

Subscribe to our newsletter to get the latest software protection strategies delivered to your inbox.

By submitting your email, you consent to Codekeeper contacting you and agree to our [privacy policy](https://codekeeper.co/privacy-policy) .

Attackers published malicious versions of 32 packages in Red Hat's @redhat-cloud-services npm scope on Monday, June 1 — all within 72 seconds, pointing to automation. Researchers traced the entry point to a compromised Red Hat employee GitHub account, with GitHub Actions OIDC credentials used to publish. The affected packages have drawn nearly 10 million downloads over their lifetime. The malware is a variant of the "Mini Shai-Hulud" worm, carrying the internal name "Miasma: The Spreading Blight." It harvests GitHub secrets, npm tokens, cloud credentials, SSH keys, Kubernetes and Vault material and more, then exfiltrates to attacker-controlled servers. At least 210 repositories containing stolen credentials have been identified. Attribution is open. TeamPCP released this worm's source code publicly the previous month, so researchers say it could be TeamPCP or a copycat. Critically, the payload ran from a preinstall hook — it executed during npm install, before the package was ever imported. Whether your code called the library is irrelevant. Red Hat has published clean versions of all 32 packages and removed the malicious ones. It says the packages were limited to internal development, never published for customer consumption, and that it found no impact to customer or partner environments. If you installed a compromised version, treat the environment as breached. Rotate every reachable credential, check lockfiles and CI logs for the affected versions, and rebuild from clean environments rather than reusing runners, workspaces or cached node_modules. Source: [SecurityWeek](https://www.securityweek.com/supply-chain-attack-hits-32-red-hat-npm-packages/)

Share this article [![Share on facebook](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Facebook.svg)](http://www.facebook.com/share.php?u=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fred-hat-npm-hack-malware-attack%3Futm_medium%3Dsocial%26utm_source%3Dfacebook) [![Share on linkedin](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Linkedin.svg)](http://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fred-hat-npm-hack-malware-attack%3Futm_medium%3Dsocial%26utm_source%3Dlinkedin) [![Share on twitter](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20X.svg)](https://twitter.com/intent/tweet?original_referer=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fred-hat-npm-hack-malware-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&url=https%3A%2F%2Fcodekeeper.co%2Fticker%2Fred-hat-npm-hack-malware-attack%3Futm_medium%3Dsocial%26utm_source%3Dtwitter&source=tweetbutton&text=) [![Share on email](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Mail.svg)](mailto:?subject=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fred-hat-npm-hack-malware-attack%3Futm_medium%3Dsocial%26utm_source%3Demail%20&body=Check%20out%20https%3A%2F%2Fcodekeeper.co%2Fticker%2Fred-hat-npm-hack-malware-attack%3Futm_medium%3Dsocial%26utm_source%3Demail) ![Copy link](https://codekeeper.co/hubfs/Codekeeper%202025/Icons/Blog%20-%20Copy.svg)

![blog_book_a_demo_cta_3x](https://codekeeper.co/hubfs/_sized/Codekeeper%202025/blog_book_a_demo_cta_3x-768x512.webp)

Have questions about protecting your software?

Our escrow experts are standing by to help.

[Book a free demo](https://codekeeper.co/book-a-demo)

YOU MAY ALSO LIKE

[South Korea Hits Coupang With Record $400M+ in Data Breach Fines Aug 12, 2026](https://codekeeper.co/ticker/coupang-data-breach-fine-400-million)

[AWS Links npm Supply Chain Attacks to North Korean Hackers Aug 11, 2026](https://codekeeper.co/ticker/north-korean-group-targets-npm-libraries)

[Data breaches NHS Worker Shared Patient Records With Partner, Victims Demand Justice Aug 20, 2026](https://codekeeper.co/ticker/somerset-nhs-data-breach-patient-privacy-concerns)

[Cyberattacks China-Linked Warlock Ransomware Still Breaking Into Utilities Oct 5, 2026](https://codekeeper.co/ticker/warlock-ransomware-sharepoint-attacks)