Red Hat NPM Packages Backdoored in Supply Chain Attack
Attackers compromised a Red Hat employee's GitHub account and CI/CD pipeline to publish 96 malicious versions of 32 @redhat-cloud-services NPM packages. The Miasma credential-stealing worm (Mini Shai-Hulud variant) was injected via preinstall hook. Packages had nearly 10M downloads; over 200 downstream repos exposed harvested credentials.
- github secrets
- npm tokens
- cloud credentials
- ssh keys
A supply chain attack compromised 32 official @redhat-cloud-services NPM packages, resulting in the publication of 96 malicious versions that collectively received nearly 10 million downloads. The incident exposed GitHub secrets, NPM tokens, cloud credentials, and SSH keys from affected build environments and downstream repositories, with public reporting indicating that more than 200 downstream projects had credentials harvested by the embedded malware.
According to reporting from SecurityWeek, attackers first gained control of a Red Hat employee’s GitHub account and the associated CI/CD pipeline. They then injected the Miasma credential-stealing worm, identified as a Mini Shai-Hulud variant, through a malicious preinstall hook. The compromised packages remained available on the NPM registry until discovered and removed. Industry research from sources such as DoxxScan™ continuous monitoring indicates that credential leaks of this nature frequently appear in subsequent underground markets within days of initial exposure.
Want the rest of this breakdown?
Sign up free to keep reading. Members get extended access, the weekly breach digest, and a complimentary Warden™ to see if their identity is exposed in the breaches we cover.
A breach leaks your credentials. Then hackers chain those credentials to your address, family, phone, and employer using public broker sites. We’re the only tool built around that chain.
⚠ Were you in this breach?
Free email scanner. We check your address against 15.4B+ leaked records (including this breach) in 15 seconds — then show you the $19 cleanup that removes you from the broker sites aggregating leaked data.
Check my email — free →
