Red Hat npm Supply Chain Attack Spreads Shai-Hulud 'Miasma' Malware

More than 30 npm packages under the @redhat-cloud-services namespace were compromised in a sophisticated supply‑chain attack that delivered a new variant of the Shai‑Hulud credential‑stealing malware, nicknamed “Miasma.” Security researchers at Aikido and OX Security discovered the campaign, which uploaded backdoored versions of popular development libraries and affected roughly 117,000 weekly downloads.

The breach originated when an attacker apparently compromised a Red Hat employee’s GitHub account and pushed malicious commits to multiple repositories. Those commits added a GitHub Actions workflow that, when triggered, installed Bun and executed a script (_index.js) with a list of target packages supplied via the OIDC_PACKAGES environment variable. The workflow requested a short‑lived OIDC token using the id-token: write permission and used that token to authenticate directly with npm’s trusted publishing endpoint, publishing backdoored releases of each package. The malicious packages contained a preinstall script that silently executed a heavily obfuscated index.js payload (approximately 4.2 MB) designed to harvest GitHub Actions secrets, AWS and Google Cloud credentials, Azure service‑principal tokens, HashiCorp Vault tokens, Kubernetes service‑account tokens, npm/PyPI publishing tokens, SSH keys, Docker credentials, GPG keys, and .env files.

Red Hat confirmed the incident and removed the compromised packages from the npm registry. The company emphasized that the affected packages were limited to internal development tooling and were never exposed through console.redhat.com, adding that no impact to customer environments or production systems has been identified. Aikido’s analysis identified 32 packages with 96 distinct versions impacted, spanning numerous client libraries used by developers across the ecosystem.

Developers who rely on @redhat-cloud-services packages should audit their installations for the malicious preinstall hook and revoke any exposed secrets immediately. Proactive measures such as running an email breach checker to see if corporate email addresses have been leaked, using a password checker to ensure no weak or reused credentials exist, and reviewing OIDC token permissions in CI/CD pipelines can help mitigate the risk of similar supply‑chain attacks.