Shai-Hulud malware worms Red Hat npm package versions downloaded 80K times a week
Researchers found a supply-chain attack in Red Hat npm releases, with malware hiding in preinstall hooks and targeting credentials. Red Hat says it removed the packages and has not seen customer impact.
Intelligence analysis by GPT-5.4 Mini
Security researchers say at least 32 Red Hat npm package releases were poisoned with Mini Shai-Hulud malware after a Red Hat GitHub account was compromised. The infected packages were downloaded about 80,000 times a week and the payload was built to steal secrets and credentials from developer and cloud environments.
A bad piece of software hid inside some package updates that programmers download. It was like sneaking a thief into a delivery box before the box even got opened.
When a developer installed the package, the hidden code could try to grab passwords, keys, and other secret notes from computers and cloud accounts. That can let the thief sneak into more places later.
Red Hat says it removed the bad packages and has not seen harm to customer systems. But security teams still worry because one poisoned package can spread trouble to many computers very quickly.
Analysis
What happened
Security researchers from Wiz say they found dozens of Red Hat npm package releases infected with a Mini Shai-Hulud worm. The attack appears to have started from one Red Hat employee’s compromised GitHub account, which was used to push malicious orphan commits into two RedHatInsights repositories and bypass code review. Wiz says it saw two waves of activity and is treating the incident as a live threat.
Scale and exposure
The affected packages live under the Red Hat Cloud Services namespace. Wiz says the infected releases are downloaded about 80,000 times per week, while Socket counted 95 affected package versions as of a specific UTC timestamp. Red Hat said it quickly began an investigation and removed the packages from the npm registry. It also said the malicious code was limited to internal development and was not published to customers through the console.redhat.com system.
What the malware does
The compromised versions use a hidden preinstall hook, which means the payload runs during npm install before a developer ever imports the package. Socket says the payload is designed to collect GitHub Actions secrets, npm tokens, cloud credentials, Kubernetes and Vault material, SSH keys, Git credentials, and other sensitive files. Socket also says the malware has encrypted exfiltration logic and GitHub-based fallback paths, which suggests the attacker wanted both credential theft and possible further spread.
Why the variant matters
Wiz says the code looks closely related to Mini Shai-Hulud, the worm TeamPCP recently open-sourced, but it is not clear whether TeamPCP or a copycat is behind this campaign. Wiz says the changes are mostly cosmetic, with Dune-themed references replaced by Greek mythology language, but the core tradecraft remains similar. A notable difference is that this version adds collectors for Google Cloud Platform and Microsoft Azure identities, and it creates repositories with the description “Miasma: The Spreading Blight.” Wiz also says each infection gets a uniquely encrypted payload, which weakens hash-based detection across versions.
Key points
- Researchers found at least 32 Red Hat npm releases infected with Mini Shai-Hulud malware.
- The affected packages are downloaded about 80,000 times a week.
- The malware runs through a preinstall hook during npm install.
- Socket says the payload targets developer, cloud, and repository credentials.
- Red Hat says it removed the packages and has not seen customer impact.
Red Hat says it removed the packages from npm and has not identified impact to customer or partner environments or Red Hat production systems. If that holds, the incident may remain contained to internal development systems and stop spreading further. Wiz and Socket are actively tracking the artifacts, which can help other teams find and remove affected versions quickly.
If any organization or pipeline installed a poisoned version, the article says it should assume compromise and rotate credentials immediately. Because the malware targets GitHub, npm, cloud, Kubernetes, Vault, and SSH material, one infected install could expose many layers of access. The unique encrypted payload per infection also makes generic hash-based detection less effective, which can slow response and let some compromises go unnoticed.
