Dozens of Red Hat packages backdoored through its offical NPM channel
Red Hat’s official npm namespace was compromised, and more than 30 packages were used to spread a credential-stealing worm called Shai-Hulud.
Intelligence analysis by GPT-5.4 Mini
Researchers say attackers took over Red Hat’s @redhat-cloud-services npm namespace and pushed malicious packages that run during install, steal secrets, and spread to other accounts. Red Hat says it removed the packages and has not found impact to customer or partner environments yet.
A company’s toolbox for software got broken into. The bad guys hid a tiny sneaky program inside some trusted boxes, so when developers opened them, the sneaky program could copy secret keys.
It is like a toy box that looks normal but also has a bug that crawls out, steals house keys, and then hides in other toy boxes. Because people trust the box, they may not notice anything is wrong right away.
Red Hat says it took the bad boxes down and has not found harm to customers yet. But anyone who opened the boxes is being told to check everything carefully, because secret keys can be used to get into many other places.
Analysis
What happened
Researchers at Aikido said official Red Hat accounts in npm were compromised and used to publish a malicious worm. The attack affected the @redhat-cloud-services namespace, which is meant for official Red Hat packages and is therefore widely trusted by developers.
Why the malware is dangerous
The malware runs during npm install, before a package is actually imported or used by application code. Socket said the payload is built to gather sensitive credentials, including GitHub Actions secrets, npm tokens, Kubernetes and Vault material, and other cloud-service credentials. It then tries to spread by republishing backdoored packages to third-party accounts the infected machine can reach.
The worm also focuses on CI/CD environments. According to the article, the malware was published through GitHub Actions OIDC, which suggests Red Hat’s pipeline was compromised. That matters because CI/CD systems often have broad access to build systems, repositories, and cloud resources.
Red Hat’s response and the remaining risk
Red Hat said it removed the malicious packages. In its email, the company said the affected packages were limited to internal development and were never published for customer consumption through console.redhat.com. It also said it has not identified impact to customer or partner environments or Red Hat production systems so far.
Even with that reassurance, the article’s core warning is blunt: anyone who installed one of the affected package versions should treat workstations, CI/CD pipelines, and cloud credentials as potentially compromised. The piece also points to the difficulty of fully cleaning up after supply-chain attacks, citing a prior Checkmarx incident where the attacker was not fully removed and later returned.
Key points
- Red Hat’s official npm namespace was compromised and used to publish malicious packages.
- More than 30 packages appear to have been affected, and many were later taken down.
- The malware runs during `npm install` and is designed to steal secrets from developer and CI/CD systems.
- Researchers say the worm can spread by republishing itself through accounts the infected machine can access.
- Red Hat says it removed the packages and has not identified customer or production impact so far.
Red Hat says it removed the malicious packages and has not found impact to customer or partner environments or production systems so far. If that holds, the incident may be contained to internal development infrastructure rather than spreading into downstream customer systems.
The article warns that anyone who installed an affected package version should assume their workstation, CI/CD pipeline, and cloud credentials may be compromised. Because the malware can spread through trusted accounts and automated pipelines, a missed credential or incomplete cleanup could let the attacker keep moving.
