Supply Chain Attack Compromises 30+ Red Hat npm Packages, Harvests Cloud Credentials
What Happened — Attackers hijacked a Red Hat employee’s GitHub account and pushed malicious orphan commits to two RedHatInsights repositories, publishing more than 30 compromised npm packages on June 1 2026. The packages contain a 4.2 MB obfuscated JavaScript payload (Mini Shai‑Hulud) that runs during npm install, steals cloud and CI/CD credentials, and attempts to self‑propagate by publishing back‑doored packages using the bypass_2fa flag.
Why It Matters for TPRM —
- Supply‑chain compromise of a trusted vendor can expose downstream customers to credential theft and further malware spread.
- Automated token harvesting bypasses 2FA, undermining assumed security controls in CI pipelines.
- Rapid removal of packages does not guarantee that all downstream environments have been cleansed.
Who Is Affected — Technology SaaS providers, enterprises using Red Hat Cloud Services, and any organization that installed the compromised npm packages (including developers, CI/CD pipelines, and cloud workloads).
Recommended Actions —
- Identify any internal projects that consumed the affected npm versions and revert to clean releases.
- Rotate all harvested credentials (AWS, GCP, Azure keys; GitHub Actions tokens; HashiCorp Vault tokens; Kubernetes configs; SSH keys; npm/PyPI publish tokens).
- Audit GitHub and npm account activity for unauthorized commits or package publications.
- Strengthen token management: enforce least‑privilege, use short‑lived tokens, and disable
bypass_2fawhere possible.
Technical Notes — The malware leverages npm’s preinstall lifecycle hook to execute before application code, exfiltrates a wide range of cloud and CI/CD tokens, and uses the bypass_2fa publish parameter to override two‑factor authentication. The payload is a new variant of TeamPCP’s Mini Shai‑Hulud, featuring per‑infection encrypted payloads and new cloud‑identity collectors. Source: Help Net Security