New Shai Hulud Variant Hits Red Hat npm Packages

UPDATE - It seems like every day we’re seeing another npm supply chain attack that stems from the self-propagating software supply chain worm known as Mini Shai Hulud. The latest incident occurred on Monday when multiple @redhat-cloud-services packages on npm were compromised – but this time, by a new variant of the malware, dubbed Miasma. 

@redhat-cloud-services is the npm namespace typically used by Red Hat's cloud services teams to publish frontend components, clients, and tooling. Packages in this namespace (which include @redhat-cloud-services/chrome, @redhat-cloud-services/frontend-components, or @redhat-cloud-services/compliance-client) are used by Red Hat developers and organizations building integrations with Red Hat cloud services. Researchers said they saw 96 compromised versions across 32 packages. To give a sense of the scope, these packages are cumulatively downloaded almost 117,000 times a week.

In a Monday update, Red Hat said that it has removed the compromised versions from npm following disclosure.

Researchers with Aikido Security said the payload that was embedded in the impacted packages resembles Mini Shai Hulud – but this version calls itself “Miasma” and seems to have replaced the reference to Dune with Greek mythology (in mythology, miasma is a contagious power). 

“The malware appears similar to the Mini Shai-Hulud malware that was recently open-sourced by TeamPCP,” said Ilyas Makari with Aikido Security on Monday. “Since the tooling was made publicly available, other threat actors now have access to the same techniques and can replicate or adapt them.”

Like Mini Shai Hulud, the malware variant steals GitHub tokens, npm tokens, as well as AWS, GCP and Azure cloud credentials. However, researchers with OX Security said that threat actors have also now added two more dropper and encryption layers to further hide their infostealer logic with this variant. 

The emergence of Miasma indicates a worrying escalation in the existing software supply chain attacks we’ve seen this year (as if we needed that). Now that TeamPCP has made Mini Shai Hulud open source, other groups can use that framework and add their own twists in attacks against new targets.

Notably, the packages were published via GitHub Actions OpenID Connect (OIDC), a feature that allows a GitHub Actions workflow to authenticate to cloud providers and other services without storing long-lived secrets (like API keys, cloud access keys, or passwords) in GitHub. This indicates that the CI/CD pipeline was compromised rather than an npm token, as we’ve previously seen with the TanStack and Bitwarden compromises. Researchers said that they found a Red Hat employee's GitHub account had been compromised and was used by threat actors to push malicious orphan commits directly to several repositories, bypassing code review.

“Trusted publishing is a mechanism npm introduced to eliminate long-lived publish tokens from CI/CD pipelines, replacing them with short-lived OIDC tokens issued by GitHub Actions,” according to Makari. “It was designed to be more secure, but as recent attacks show, it can be bypassed if an attacker gains access to a CI/CD pipeline through a vulnerability or compromised token.”

Researchers with Aikido Security urged potentially impacted developers that have installed any impacted package versions (since June 1, 2026), to “treat all CI secrets, cloud credentials, SSH keys, and npm tokens as compromised and rotate them immediately.” OX Security researchers also recommended adding two-factor authentication (2FA) to accounts and downgrading impacted packages to safe versions. For a full list of the compromised packages and versions, check out Aikido Security’s Indicators of Compromise section in their research. 

This post was updated with information from a new Red Hat advisory.