Attackers published malicious versions of 32 packages in Red Hat's @redhat-cloud-services npm scope on Monday, June 1 — all within 72 seconds, pointing to automation. Researchers traced the entry point to a compromised Red Hat employee GitHub account, with GitHub Actions OIDC credentials used to publish. The affected packages have drawn nearly 10 million downloads over their lifetime.
The malware is a variant of the "Mini Shai-Hulud" worm, carrying the internal name "Miasma: The Spreading Blight." It harvests GitHub secrets, npm tokens, cloud credentials, SSH keys, Kubernetes and Vault material and more, then exfiltrates to attacker-controlled servers. At least 210 repositories containing stolen credentials have been identified.
Attribution is open. TeamPCP released this worm's source code publicly the previous month, so researchers say it could be TeamPCP or a copycat.
Critically, the payload ran from a preinstall hook — it executed during npm install, before the package was ever imported. Whether your code called the library is irrelevant.
Red Hat has published clean versions of all 32 packages and removed the malicious ones. It says the packages were limited to internal development, never published for customer consumption, and that it found no impact to customer or partner environments.
If you installed a compromised version, treat the environment as breached. Rotate every reachable credential, check lockfiles and CI logs for the affected versions, and rebuild from clean environments rather than reusing runners, workspaces or cached node_modules.
Source: SecurityWeek
