Red Hat npm packages compromised to steal developer credentials
More than 30 Red Hat npm packages were tainted with Miasma malware to steal developer secrets, with about 117,000 weekly downloads affected.
Intelligence analysis by GPT-5.4 Mini
Security firms Aikido and OX Security found backdoored versions of Red Hat npm packages that used a malicious preinstall script to steal credentials and cloud secrets. Red Hat says it removed the packages and has not found customer or partner impact so far.
A company’s software boxes were changed so that, when people opened them, they quietly copied keys and passwords. That is a supply-chain attack: the trick happens before the software even gets to the user.
Think of it like a toy factory where one robot sneaks in a secret copier. When a store gets the toy and puts batteries in it, the copier wakes up and steals house keys from the room.
The scary part is that the stolen keys can open many different doors, like cloud accounts, code systems, and servers. That is why the article says people who used the bad versions should change their secrets fast.
Analysis
What happened
Security firms Aikido and OX Security say more than 30 npm packages under Red Hat’s @redhat-cloud-services namespace were compromised in a supply-chain attack. The attackers allegedly used a Red Hat employee’s GitHub account to push malicious commits, then abused GitHub Actions and npm’s trusted publishing flow to release backdoored package versions.
The malicious packages included a preinstall script that ran automatically when developers installed them. That script executed an obfuscated payload, which Aikido says was about 4.2 MB and built to collect a wide range of secrets: GitHub Actions credentials, AWS and Google Cloud keys, Azure service principal credentials, HashiCorp Vault tokens, Kubernetes service account tokens, npm and PyPI publishing tokens, SSH keys, Docker credentials, GPG keys, and .env files.
How far it spread
Aikido says 32 packages and 96 versions were affected, with roughly 117,000 weekly downloads across the compromised packages. Red Hat said it removed the packages from npm after learning of the incident and said the issue was limited to internal development tooling. The company said it has not identified impact to customer or partner environments or to Red Hat production systems, though its investigation is still ongoing.
Why researchers are concerned
Researchers say the malware resembles the earlier Shai-Hulud wave, and that this variant uses the string Miasma: The Spreading Blight in compromised GitHub repositories. OX Security said the payload keeps the credential-theft behavior seen in Mini Shai-Hulud, but adds more obfuscation, multi-stage delivery, and broader data theft. At the time of reporting, researchers said 309 GitHub repositories had been compromised in the Miasma campaign.
Key points
- More than 30 Red Hat npm packages in the `@redhat-cloud-services` namespace were compromised.
- The malicious versions used a `preinstall` script to run malware during package installation.
- Researchers say the payload was built to steal many kinds of credentials, keys, and tokens.
- Red Hat removed the packages and says it has not found customer or partner impact so far.
- Aikido and OX Security say the campaign looks like a new Shai-Hulud variant called Miasma.
Red Hat says it removed the affected packages quickly after becoming aware of the incident, which limits further exposure from the registry. The company also says it has not identified customer, partner, or production-system impact so far.
The stolen data includes credentials and tokens that can be reused for broader access if they were captured from infected developer systems. Researchers also say the campaign has already compromised hundreds of GitHub repositories, which suggests the malware may continue spreading through trusted workflows.
